PT-2025-12078 · Fastchat · Fastchat

Published 2025-03-20 · Updated 2025-03-21 · CVE-2024-10908

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions fastchat version 0.2.36

Description An open redirect issue allows a remote unauthenticated attacker to redirect users to arbitrary websites via a specially crafted URL. This can be exploited for phishing attacks, malware distribution, and credential theft.

Recommendations For version 0.2.36, update to a newer version that contains a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to URLs that could be used for redirecting users to minimize the risk of exploitation. Avoid using URLs that could be manipulated by an attacker until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-10908

GHSA-77CJ-RV5X-V6R2

Affected Products

Fastchat

References · 6

• 🔥 https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2 · Exploit
• https://osv.dev/vulnerability/GHSA-77cj-rv5x-v6r2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10908 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10908 · Security Note
• https://github.com/lm-sys/FastChat · Note
• https://twitter.com/CVEnew/status/1902968853568819327 · Twitter Post