CVE-2024-32964 - Vulnerability Details - OpenCVE

Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.53733.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

lobehub

lobe-chat

affected

Version	Status	Constraints
`<= 0.150.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors	Products
Lobehub Subscribe	Lobe Chat Subscribe

Project Subscriptions

Vendors	Products
Lobehub Subscribe	Lobe Chat Subscribe

Advisories

Source	ID	Title
Github GHSA	GHSA-mxhq-xw3g-rphc	lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37
https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc

History

Tue, 30 Sep 2025 14:45:00 +0000

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:lobehub:lobe_chat::::::::

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-05-10T14:49:31.019Z

Updated: 2024-08-02T02:27:53.559Z

Reserved: 2024-04-22T15:14:59.164Z

Link: CVE-2024-32964

Vulnrichment

Updated: 2024-08-02T02:27:53.559Z

NVD

Status : Analyzed

Published: 2024-05-14T15:37:18.180

Modified: 2025-09-30T14:35:10.233

Link: CVE-2024-32964

Redhat

No data.

OpenCVE Enrichment

Updated: 2025-07-12T22:31:32Z

Weaknesses

CWE-918

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-32964", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-04-22T15:14:59.164Z", "datePublished": "2024-05-10T14:49:31.019Z", "dateUpdated": "2024-08-02T02:27:53.559Z"}, "containers": {"cna": {"title": "lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"}, {"name": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "tags": ["x_refsource_MISC"], "url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37"}], "affected": [{"vendor": "lobehub", "product": "lobe-chat", "versions": [{"version": "<= 0.150.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-10T14:49:31.019Z"}, "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information."}], "source": {"advisory": "GHSA-mxhq-xw3g-rphc", "discovery": "UNKNOWN"}}, "adp": [{"affected": [{"vendor": "lobehub", "product": "lobe_chat", "cpes": ["cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "0.150.6", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-10T17:50:39.544520Z", "id": "CVE-2024-32964", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T17:36:50.260Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.559Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"}, {"name": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "name": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T02:27:53.559Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-32964", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-10T17:50:39.544520Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*"], "vendor": "lobehub", "product": "lobe_chat", "versions": [{"status": "affected", "version": "0", "lessThan": "0.150.6", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-10T17:52:13.975Z"}}], "cna": {"title": "lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability", "source": {"advisory": "GHSA-mxhq-xw3g-rphc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "lobehub", "product": "lobe-chat", "versions": [{"status": "affected", "version": "<= 0.150.5"}]}], "references": [{"url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "name": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "name": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-05-10T14:49:31.019Z"}}}, "cveMetadata": {"cveId": "CVE-2024-32964", "state": "PUBLISHED", "dateUpdated": "2024-08-02T02:27:53.559Z", "dateReserved": "2024-04-22T15:14:59.164Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-05-10T14:49:31.019Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lobehub:lobe_chat:*:*:*:*:*:*:*:*", "matchCriteriaId": "F535CACD-58A3-47EB-980A-B200CEE751E9", "versionEndExcluding": "0.150.6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Lobe Chat is a chatbot framework that supports speech synthesis, multimodal, and extensible Function Call plugin system. Prior to 0.150.6, lobe-chat had an unauthorized Server-Side Request Forgery vulnerability in the /api/proxy endpoint. An attacker can construct malicious requests to cause Server-Side Request Forgery without logging in, attack intranet services, and leak sensitive information."}, {"lang": "es", "value": "Lobe Chat es un framework de chatbot que admite s\u00edntesis de voz, sistema de complemento de llamada de funci\u00f3n multimodal y extensible. Antes de la versi\u00f3n 0.150.6, lobe-chat ten\u00eda una vulnerabilidad de Server Side Request Forgery no autorizada en el endpoint /api/proxy. Un atacante puede crear solicitudes maliciosas para provocar una Server Side Request Forgery sin iniciar sesi\u00f3n, atacar servicios de intranet y filtrar informaci\u00f3n confidencial."}], "id": "CVE-2024-32964", "lastModified": "2025-09-30T14:35:10.233", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 6.0, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-05-14T15:37:18.180", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/lobehub/lobe-chat/commit/465665a735556669ee30446c7ea9049a20cc7c37"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/lobehub/lobe-chat/security/advisories/GHSA-mxhq-xw3g-rphc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}