PT-2025-12129 · Unknown · Lm-Sys/Fastchat

Published 2025-03-20 · Updated 2025-03-20 · CVE-2024-12376

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions lm-sys/fastchat version git 2c68a13

Description A Server-Side Request Forgery (SSRF) issue was identified, allowing an attacker to access internal server resources and data, such as AWS metadata credentials, that are otherwise inaccessible.

Recommendations For version git 2c68a13, consider restricting access to internal server resources to minimize the risk of exploitation. As a temporary workaround, review and limit the use of sensitive data, such as AWS metadata credentials, until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-12376

GHSA-G44M-HPF4-VMRP

Affected Products

Lm-Sys/Fastchat

References · 6

• 🔥 https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-12376 · Security Note
• https://osv.dev/vulnerability/GHSA-g44m-hpf4-vmrp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-12376 · Vendor Advisory
• https://github.com/lm-sys/FastChat · Note
• https://twitter.com/CVEnew/status/1902671112129151218 · Twitter Post