Miggo Logo
Miggo Vulnerability Database
→
CVE-2024-37895

CVE-2024-37895:
Lobe Chat API Key Leak

5.7

CVSS Score
3.1

Basic Information

CVE ID
CVE-2024-37895
GHSA ID
GHSA-p36r-qxgx-jq2v
EPSS Score
0.11306%
CWE
CWE-200
Published
6/17/2024
Updated
6/17/2024
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
@lobehub/chatnpm< 0.162.250.162.25

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability combines two critical failures: 1) Unrestricted base URL modification allows SSRF (CWE-918), and 2) Sensitive API keys are included in requests to attacker-controlled endpoints (CWE-200). The first function likely handles user input for base URL without validation(), while the second function would be responsible for attaching sensitive headers to outbound requests. These would work in tandem to enable the described attack flow where authenticated users can exfiltrate credentials via modified endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Summ*ry I* *n *tt**k*r **n su***ss*ully *ut**nti**t* t*rou** SSO/****ss *o**, t**y **n o*t*in t** r**l ***k*n* *PI K*y *y mo*i*yin* t** **s* URL to t**ir own *tt**k URL on t** *ront*n* *n* s*ttin* up * s*rv*r-si** r*qu*st. ### **t*ils T** *tt*

Reasoning

T** vuln*r**ility *om*in*s two *riti**l **ilur*s: *) Unr*stri*t** **s* URL mo*i*i**tion *llows SSR* (*W*-***), *n* *) S*nsitiv* *PI k*ys *r* in*lu*** in r*qu*sts to *tt**k*r-*ontroll** *n*points (*W*-***). T** *irst `*un*tion` lik*ly **n*l*s us*r inp