Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-11603

CVE-2024-11603: FastChat Server-Side Request Forgery vulnerability

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2024-11603
GHSA ID
GHSA-h254-g997-685c
EPSS Score
0.33938%
CWE
CWE-918
Published
3/20/2025
Updated
3/21/2025
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
fschatpip

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability centers around the /queue/join endpoint which is typically handled by controller worker APIs in FastChat's architecture. The advisory specifically mentions insufficient path parameter validation in this endpoint. In FastChat's implementation, the recv_heartbeat() function in controller.py is responsible for worker registration and queue management, making it the logical handler for this endpoint. The lack of input validation for network-bound parameters in this function would enable SSRF by allowing manipulation of request targets. Confidence is high as this aligns with FastChat's architecture patterns and the explicit endpoint reference in advisories.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* S*rv*r-Si** R*qu*st *or**ry (SSR*) vuln*r**ility *xists in lm-sys/**st***t v*rsion *.*.**. T** vuln*r**ility is pr*s*nt in t** `/qu*u*/join?` *n*point, w**r* insu**i*i*nt v*li**tion o* t** p*t* p*r*m*t*r *llows *n *tt**k*r to s*n* *r**t** r*qu*sts.

Reasoning

T** vuln*r**ility **nt*rs *roun* t** /qu*u*/join *n*point w*i** is typi**lly **n*l** *y *ontroll*r work*r *PIs in **st***t's *r**it**tur*. T** **visory sp**i*i**lly m*ntions insu**i*i*nt p*t* p*r*m*t*r `v*li**tion` in t*is *n*point. In **st***t's imp