PT-2024-20457 · Lobe Chat · Lobe Chat

Dastaj · Published 2024-01-31 · Updated 2024-02-09 · CVE-2024-24566

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 0.122.4

Description The issue allows access to plugins without proper authorization when the application is password-protected and deployed with the ACCESS CODE option. This means that even though the application requires a password to access the chat, plugins can still be interacted with without entering the password. For example, an HTTP request to the "/api/plugin/gateway" endpoint can be made without providing the ACCESS CODE, allowing unauthorized access to plugins.

Recommendations For versions prior to 0.122.4, update to version 0.122.4 or later to resolve the issue. As a temporary workaround, consider verifying the ACCESS CODE for HTTP requests to the /api/plugin/ route to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-24566

GHSA-PF55-FJ96-XF37

Affected Products

Lobe Chat

References · 10

• 🔥 https://github.com/lobehub/lobe-chat/security/advisories/GHSA-pf55-fj96-xf37 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24566.json · Exploit
• https://github.com/lobehub/lobe-chat/commit/2184167f09ab68e4efa051ee984ea0c4e7c48fbd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-24566 · Security Note
• https://osv.dev/vulnerability/CVE-2024-24566 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pf55-fj96-xf37 · Vendor Advisory
• https://github.com/lobehub/lobe-chat · Note
• https://t.me/cvenotify/70816 · Telegram Post
• https://twitter.com/CVEnew/status/1752736625405087849 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1752789575670415459 · Twitter Post