CVE-2024-37895

描述

### Summary If an attacker can successfully authenticate through SSO/Access Code, they can obtain the real backend API Key by modifying the base URL to their own attack URL on the frontend and setting up a server-side request. ### Details The attack process is described above.  ### PoC Frontend: 1. Pass basic authentication (SSO/Access Code). 2. Set the Base URL to a private attack address. 3. Configure the request method to be a server-side request. 4. At the self-set attack address, retrieve the API Key information from the request headers. Backend: 1. The LobeChat version allows setting the Base URL. 2. There is no outbound traffic whitelist. ### Impact All community version LobeChat users using SSO/Access Code authentication, tested on version 0.162.13.

受影響套件(1)

• npm/@lobehub/chatfrom 0, < 0.162.25

CVSS 分數

參考連結(3)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-37895
• PATCHhttps://github.com/lobehub/lobe-chat
• WEBhttps://github.com/lobehub/lobe-chat/security/advisories/GHSA-p36r-qxgx-jq2v