PT-2024-27816 · Lobe Chat · Lobe Chat

Zhuozhiyongde · Published 2024-06-17 · Updated 2025-10-08 · CVE-2024-37895

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lobe Chat versions prior to 0.162.25

Description The issue allows an attacker to obtain the real backend API Key if they can successfully authenticate through SSO/Access Code. This is achieved by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. The attack process involves passing basic authentication, setting the Base URL to a private attack address, configuring the request method to be a server-side request, and retrieving the API Key information from the request headers at the self-set attack address.

Recommendations For versions prior to 0.162.25, upgrade to version 0.162.25 or later to address the issue. As a temporary workaround, consider restricting the ability to modify the base URL on the frontend to prevent attackers from setting up a server-side request to obtain the API Key. Additionally, configuring an outbound traffic whitelist on the backend can help minimize the risk of exploitation.

Exploit

Fix

Information Disclosure

SSRF

Weakness Enumeration

CWE-200

CWE-918

Related Identifiers

CVE-2024-37895

GHSA-P36R-QXGX-JQ2V

Affected Products

Lobe Chat

References · 8

• 🔥 https://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37895.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-37895 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p36r-qxgx-jq2v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-37895 · Security Note
• https://github.com/lobehub/lobe-chat · Note
• https://t.me/cveNotify/137833 · Telegram Post
• https://t.me/echeloneyes/2937 · Telegram Post