CVE-2024-32965: lobehub lobe chat

csirt@kutim:~/threat-intel/cve/CVE-2024-32965

CVSS 8.6 · High EPSS 28,6%

Kerentanan Server-Side Request Forgery (SSRF) pada lobehub lobe chat. Skor CVSS 3.1 8.6 (High) menurut NVD.

Deskripsi (NVD)

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Rincian

Terbit di NVD: 26 November 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Analyzed
CVSS 3.1: 8.6 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 28,6% peluang dieksploitasi; lebih tinggi dari 98,1% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lobehub	lobe chat	Semua versi sebelum 1.19.13

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/lobehub/lobe-chat/security/advisories/GHSA-2xcc-vm3f-m8rw exploit · advisory vendor
https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf patch

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.