Danny-Avila

**Name of the Vulnerable Software and Affected Versions** LibreChat versions prior to 0.8.3 **Description** LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.3, the `isPrivateIP()` function in `packages/api/src/auth/domain.ts` does not correctly identify IPv4-mapped IPv6 addresses in their hex-normalized form. This allows any authenticated user to bypass Server-Side Request Forgery (SSRF) protection. Successful exploitation enables the server to make HTTP requests to internal network resources, including cloud metadata services (e.g., AWS `169.254.169.254`), loopback, and RFC1918 ranges. The vulnerable function is `isPrivateIP()`. The affected API endpoint is not explicitly mentioned. **Recommendations** Upgrade to version 0.8.3 to resolve this issue.

**Nome do Software Vulnerável e Versões Afetadas** LibreChat versões anteriores a 0.8.3-rc1 **Description** Uma Referência Direta a Objeto Insegura (IDOR) existe no endpoint 'PUT /api/keys'. Devido ao uso do operador spread de objetos do JavaScript após a definição do ID do usuário autenticado, um usuário autenticado pode injetar um parâmetro `userId` no corpo da requisição para sobrescrever as chaves de API de outro usuário. Isso permite que um invasor substitua a configuração de chaves de API de uma vítima para provedores como OpenAI, Anthropic ou Azure, o que poderia rotear conversas através de chaves controladas pelo invasor ou causar a negação de serviço ao fornecer chaves inválidas. **Recommendations** Atualize para a versão 0.8.3-rc1.

**Name of the Vulnerable Software and Affected Versions** LibreChat versions prior to 0.8.3-rc1 **Description** A denial of service issue exists in the `DELETE /api/convos` endpoint of LibreChat. An authenticated attacker can cause the Node.js server process to crash by submitting specially crafted requests. The issue occurs because the server attempts to destructure `req.body.arg` without first verifying its existence, leading to an unhandled TypeError that terminates the process. The `DELETE /api/convos` route handler is affected. The `req.body.arg` variable is vulnerable. **Recommendations** Update to version 0.8.3-rc1 or later.