PT-2024-15992 · Unknown · Lm-Sys/Fastchat

Published 2024-12-30 · Updated 2025-07-29 · CVE-2024-10044

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat versions as of commit e208d5677c6837d590b81cb03847c0b9de100765

Description A Server-Side Request Forgery (SSRF) vulnerability exists in the "POST /worker generate stream" API endpoint of the Controller API Server. This issue allows attackers to exploit the victim controller API server's credentials to perform unauthorized web actions or access unauthorized web resources by combining it with the "POST /register worker" endpoint.

Recommendations As a temporary workaround, consider disabling the POST /worker generate stream API endpoint until a patch is available. Restrict access to the POST /register worker endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-10044

Affected Products

Lm-Sys/Fastchat

References · 9

• 🔥 https://huntr.com/bounties/44633540-377d-4ac4-b3a3-c2d0fa19d0e6 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10044 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10044 · Security Note
• https://t.me/cveNotify/130196 · Telegram Post
• https://twitter.com/CVEnew/status/1873706772218642808 · Twitter Post
• https://t.me/cvenotify/105746 · Telegram Post
• https://t.me/cvedetector/13932 · Telegram Post
• https://twitter.com/CveFindCom/status/1873701168217575935 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1873712237090623632 · Twitter Post