CVE-2024-47066: Lobehub Lobe Chat SSRF Vulnerability

CVE-2024-47066 Overview

CVE-2024-47066 is a Server-Side Request Forgery (SSRF) vulnerability in Lobe Chat, an open-source artificial intelligence chat framework. Versions prior to 1.19.13 implement SSRF protection in src/app/api/proxy/route.ts that does not account for HTTP redirects. An attacker can supply an external URL that redirects to internal resources such as private networks or loopback addresses. This bypasses the initial DNS-based check and allows the proxy to reach otherwise unreachable internal endpoints. The issue is tracked under CWE-918 and fixed in version 1.19.13.

Critical Impact
Authenticated attackers can pivot into internal networks, access cloud metadata services, and interact with loopback-bound services through the Lobe Chat proxy endpoint.

Affected Products

Lobehub Lobe Chat versions prior to 1.19.13
Deployments exposing the /api/proxy route
Self-hosted Lobe Chat instances on cloud infrastructure with metadata services

Discovery Timeline

2024-09-23 - CVE-2024-47066 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47066

Vulnerability Analysis

The vulnerability resides in the proxy route handler at src/app/api/proxy/route.ts. The original SSRF mitigation resolved the hostname of the requested URL using dns.lookup, then rejected the request if the resolved address was private via the isPrivate check from the ip package.

This check runs once before the outbound request is dispatched. It does not follow the request through subsequent HTTP redirects. An attacker-controlled external host can pass the initial validation, then respond with a 301 or 302 redirect pointing to 127.0.0.1, 169.254.169.254, or any RFC1918 address. The subsequent fetch follows the redirect and issues a request against the internal target.

The consequences include reading cloud instance metadata, contacting internal-only APIs, and probing services bound to the loopback interface of the Lobe Chat host.

Root Cause

The check performs Time-of-Check to Time-of-Use validation against a single hostname. The fetch client honors redirects without re-validating that redirected targets are non-private. Trust in the initial DNS lookup does not extend to the request chain.

Attack Vector

An authenticated user sends a POST request to /api/proxy containing an attacker-controlled URL. The attacker's server returns an HTTP redirect to an internal address. The Lobe Chat proxy follows the redirect and returns the internal response body to the attacker.

typescript

// Patched implementation in src/app/webapi/proxy/route.ts
import { NextResponse } from 'next/server';
import fetch from 'node-fetch';
import { useAgent as ssrfAgent } from 'request-filtering-agent';

/**
 * just for a proxy
 */
export const POST = async (req: Request) => {
  const url = await req.text();

  try {
    const res = await fetch(url, { agent: ssrfAgent(url) });

    return new Response(await res.arrayBuffer(), { headers: { ...res.headers } });
  } catch (err) {
    console.error(err); // DNS lookup 127.0.0.1(family:4, host:127.0.0.1.nip.io) is not allowed. Because, It is private IP address.
    return NextResponse.json({ error: 'Not support internal host proxy' }, { status: 400 });
  }
};

Source: GitHub Commit e960a23. The fix replaces the pre-request DNS check with request-filtering-agent, which validates every socket connection including those established after redirects.

Detection Methods for CVE-2024-47066

Indicators of Compromise

Outbound requests from the Lobe Chat host to 169.254.169.254, 127.0.0.1, or RFC1918 addresses originating from the proxy process
POST requests to /api/proxy containing URLs that resolve to attacker-controlled infrastructure
Proxy responses containing cloud metadata fields such as iam/security-credentials or instance-identity
Unusual DNS resolutions of hostnames such as *.nip.io, *.xip.io, or short-lived attacker domains

Detection Strategies

Inspect access logs on the /api/proxy endpoint for requests where the response body size or content type suggests internal service data
Correlate outbound connections from the Lobe Chat container or host against known internal CIDR ranges and cloud metadata endpoints
Alert on HTTP 3xx responses received by the proxy where the Location header targets a private IP

Monitoring Recommendations

Deploy egress filtering at the network layer to block traffic from application hosts to metadata services and internal management ranges
Log the full URL and final resolved address for every request made through the proxy handler
Track Lobe Chat version inventory to identify unpatched deployments below 1.19.13

How to Mitigate CVE-2024-47066

Immediate Actions Required

Upgrade Lobe Chat to version 1.19.13 or later, which integrates request-filtering-agent for redirect-aware SSRF protection
Restrict access to the /api/proxy endpoint to authenticated, trusted users only
Apply cloud provider IMDSv2 requirements to prevent unauthenticated metadata retrieval

Patch Information

The fix is committed in GitHub Commit e960a23 and released in version 1.19.13. The patch removes the one-shot DNS lookup and delegates connection filtering to request-filtering-agent, which rejects private addresses at socket creation for the initial request and every redirect. Details are published in GHSA-3fc8-2r3f-8wrg and GHSA-mxhq-xw3g-rphc.

Workarounds

Block the /api/proxy route at a reverse proxy or web application firewall until the upgrade is applied
Enforce network policies that deny egress from the Lobe Chat workload to loopback, link-local, and RFC1918 destinations
Run Lobe Chat inside a network namespace or container without access to the cloud metadata service IP

bash

# Example nginx configuration to block the proxy route pre-upgrade
location /api/proxy {
    return 403;
}

# Example iptables rule to block metadata service egress
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP