GHSA-p36r-qxgx-jq2v

Source

https://github.com/advisories/GHSA-p36r-qxgx-jq2v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-p36r-qxgx-jq2v/GHSA-p36r-qxgx-jq2v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-p36r-qxgx-jq2v

Aliases

CVE-2024-37895

Published

2024-06-17T22:28:41Z

Modified

2026-09-10T03:50:15Z

Severity

5.7 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Lobe Chat API Key Leak

Details

Summary

If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request.

Details

The attack process is described above.

PoC

Frontend:

Pass basic authentication (SSO/Access Code).
Set the Base URL to a private attack address.
Configure the request method to be a server-side request.
At the self-set attack address, retrieve the API Key information from the request headers.

Backend:

The LobeChat version allows setting the Base URL.
There is no outbound traffic whitelist.

Impact

All community version LobeChat users using SSO/Access Code authentication, tested on version 0.162.13.

Database specific

{
    "cwe_ids":  [
        "CWE-200",
        "CWE-918"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-06-17T22:28:41Z",
    "nvd_published_at":  "2024-06-17T20:15:13Z",
    "severity":  "MODERATE"
}

References

Affected packages

npm / @lobehub/chat

Package

Name: @lobehub/chat; View open source insights on deps.dev
Purl: pkg:npm/%40lobehub/chat

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

0.162.25

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-p36r-qxgx-jq2v/GHSA-p36r-qxgx-jq2v.json"