CVE-2024-32965: Lobehub Lobe Chat SSRF Vulnerability

CVE-2024-32965 Overview

Lobe Chat is an open-source AI chat framework used to build conversational interfaces over large language model providers. Versions prior to 1.19.13 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability [CWE-918]. Attackers can craft malicious requests without authentication to coerce the application into making outbound HTTP calls. The flaw resides in the proxy route handler, which accepts a target URL and forwards the request server-side. Remote attackers can use this primitive to probe internal network services and exfiltrate sensitive information. The issue was fixed in release 1.19.13.

Critical Impact

Unauthenticated attackers can pivot through the Lobe Chat proxy endpoint to scan internal networks, access intranet services, and leak sensitive data such as the OpenAI API key stored in the X-Lobe-Chat-Auth JWT header.

Affected Products

• LobeHub Lobe Chat versions prior to 1.19.13
• Self-hosted Lobe Chat web deployments exposing /api/proxy
• Containerized Lobe Chat instances accessible from untrusted networks

Discovery Timeline

• 2024-11-26 - CVE-2024-32965 published to NVD
• 2025-09-23 - Last updated in NVD database

Technical Details for CVE-2024-32965

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery in the Lobe Chat proxy API route. The endpoint accepts an attacker-controlled URL in the request body and resolves it server-side. The original implementation attempted to mitigate SSRF by resolving the hostname through dns.lookup and checking the result against the isPrivate helper from the ip package. This single-stage validation is insufficient. Attackers can bypass it using DNS rebinding, redirect chains, IPv6-mapped addresses, or alternative encodings of loopback and RFC1918 ranges. The proxy then issues the outbound request on behalf of the attacker, returning the response body and headers.

Root Cause

The pre-patch handler in src/app/api/proxy/route.ts performed a Time-of-Check to Time-of-Use (TOCTOU) DNS check. The hostname was resolved once for validation, but the subsequent fetch call performed an independent resolution. A malicious DNS server can return a public address on the first lookup and a private address on the second, defeating the private-IP filter. The check also missed loopback aliases such as 127.0.0.1.nip.io and link-local ranges.

Attack Vector

The attack requires no authentication and no user interaction. An attacker sends a POST request to the proxy endpoint with a target URL. The X-Lobe-Chat-Auth JWT header storing the proxy address and OpenAI API key can be tampered with to redirect requests at internal infrastructure. Successful exploitation enables internal network reconnaissance, cloud metadata service access, and disclosure of upstream API credentials.

// Pre-patch handler (vulnerable) - src/app/api/proxy/route.ts
-import { isPrivate } from 'ip';
-import { NextResponse } from 'next/server';
-import dns from 'node:dns';
-import { promisify } from 'node:util';
-
-const lookupAsync = promisify(dns.lookup);
-
-export const runtime = 'nodejs';
-
-export const POST = async (req: Request) => {
-  const url = new URL(await req.text());
-  let address;
-
-  try {
-    const lookupResult = await lookupAsync(url.hostname);
-    address = lookupResult.address;
-  } catch (err) {
-    console.error(`${url.hostname} DNS parser error:`, err);
-    return NextResponse.json({ error: 'DNS parser error' }, { status: 504 });
-  }
-
-  const isInternalHost = isPrivate(address);
-
-  if (isInternalHost)
-    return NextResponse.json({ error: 'Not support internal host proxy' }, { status: 400 });
-
// Source: https://github.com/lobehub/lobe-chat/commit/e960a23b0c69a5762eb27d776d33dac443058faf

Detection Methods for CVE-2024-32965

Indicators of Compromise

• Unexpected outbound connections from the Lobe Chat server to RFC1918 ranges, 169.254.169.254, or 127.0.0.0/8
• POST requests to /api/proxy or /webapi/proxy containing URLs pointing to internal hosts, cloud metadata endpoints, or DNS rebinding domains such as *.nip.io and *.xip.io
• Modified or anomalous X-Lobe-Chat-Auth JWT headers with attacker-controlled proxy fields
• HTTP 200 responses from the proxy endpoint returning content sourced from internal services

Detection Strategies

• Inspect web access logs for high-volume requests to the proxy route with varied target URLs indicating internal port scanning
• Alert on DNS queries from the application host that resolve external hostnames to private IP addresses
• Correlate JWT header modifications with outbound connection patterns at the network egress point

Monitoring Recommendations

• Capture egress NetFlow from the Lobe Chat host and baseline expected destinations, alerting on deviations
• Enable verbose logging on the proxy route handler to record full target URLs and resolved IPs
• Forward application and network telemetry to a centralized analytics platform for correlation across host and network signals

How to Mitigate CVE-2024-32965

Immediate Actions Required

• Upgrade Lobe Chat to version 1.19.13 or later across all deployments
• Rotate any OpenAI API keys and other upstream credentials that were configured in vulnerable instances
• Restrict outbound network access from the Lobe Chat host to only the required LLM provider endpoints
• Place the application behind an authenticating reverse proxy if it is exposed to untrusted networks

Patch Information

The fix is included in release 1.19.13. The patch replaces the custom DNS validation with the request-filtering-agent package, which enforces SSRF protection inside node-fetch itself. The new implementation blocks private, loopback, and link-local destinations at connection time, eliminating the TOCTOU window. Details are available in the GitHub Security Advisory GHSA-2xcc-vm3f-m8rw and the patch commit.

Workarounds

• No vendor-provided workarounds exist; upgrading is the only supported remediation
• As a compensating control, enforce egress firewall rules that deny traffic from the application host to internal CIDR ranges and cloud metadata endpoints

# Upgrade Lobe Chat to a fixed version
npm install lobe-chat@1.19.13

# Or pull the patched container image
docker pull lobehub/lobe-chat:1.19.13
docker stop lobe-chat && docker rm lobe-chat
docker run -d --name lobe-chat -p 3210:3210 lobehub/lobe-chat:1.19.13