CVE-2024-32965: Lobe Chat: pre-auth SSRF leaks OpenAI API keys

HIGHPoC AVAILABLECISA: TRACK*

Published November 26, 2024

CISO Take

Any internet-exposed Lobe Chat instance below v1.19.13 allows unauthenticated attackers to scan your internal network and steal the OpenAI API keys stored in JWT auth headers — no login required. Patch to 1.19.13 immediately and rotate all API keys that may have been exposed. If patching is delayed, block external access or strip the X-Lobe-Chat-Auth header at the reverse proxy level.

What is the risk?

High risk. CVSS 8.6 reflects the trifecta: trivial exploitation (no auth, no interaction), high confidentiality impact, and lateral movement potential into internal infrastructure. The OpenAI API key exposure compounds the risk significantly — attackers gain not only SSRF pivot capability to reach internal services but also direct access to your LLM API budget and any data flowing through it. Cloud deployments face elevated exposure due to accessible instance metadata endpoints.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
lobe_chat	—	—	No patch

Do you use lobe_chat? You're affected.

How severe is it?

CVSS 3.1

8.6 / 10

EPSS

26.1%

chance of exploitation in 30 days

Higher than 98% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

○EPSS exploit prediction: 26%

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CHigh

ILow

ALow

What should I do?

5 steps

PATCH
Upgrade to Lobe Chat ≥1.19.13 immediately — the fix is available and the advisory confirms no workarounds exist for older versions.
ROTATE
Revoke and regenerate all OpenAI API keys configured in affected instances; audit OpenAI usage logs for anomalous spend or unusual request origins.
NETWORK
Apply egress filtering to block outbound requests from the app server to RFC1918 ranges (10/8, 172.16/12, 192.168/16), loopback (127/8), and cloud metadata IPs (169.254.169.254, 100.64.0.0/10).
DETECT
Alert on HTTP responses from internal IPs appearing in application logs; monitor for modified or structurally anomalous X-Lobe-Chat-Auth headers.
WAF
Deploy SSRF-specific rules blocking internal destination addresses in any user-controlled proxy or URL parameters.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data ExtractionAuth BypassAPIFrameworkAML.T0006- Active Scanning AML.T0034- Cost Harvesting AML.T0040- AI Model Inference API Access AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system security controls

NIST AI RMF

MANAGE-2.2-Mechanisms to sustain AI system oversight

OWASP LLM Top 10

LLM06-Sensitive Information DisclosureLLM07-Insecure Plugin Design

Frequently Asked Questions

What is CVE-2024-32965?

Is CVE-2024-32965 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2024-32965, increasing the risk of exploitation.

How to fix CVE-2024-32965?

1. PATCH: Upgrade to Lobe Chat ≥1.19.13 immediately — the fix is available and the advisory confirms no workarounds exist for older versions. 2. ROTATE: Revoke and regenerate all OpenAI API keys configured in affected instances; audit OpenAI usage logs for anomalous spend or unusual request origins. 3. NETWORK: Apply egress filtering to block outbound requests from the app server to RFC1918 ranges (10/8, 172.16/12, 192.168/16), loopback (127/8), and cloud metadata IPs (169.254.169.254, 100.64.0.0/10). 4. DETECT: Alert on HTTP responses from internal IPs appearing in application logs; monitor for modified or structurally anomalous X-Lobe-Chat-Auth headers. 5. WAF: Deploy SSRF-specific rules blocking internal destination addresses in any user-controlled proxy or URL parameters.

What systems are affected by CVE-2024-32965?

This vulnerability affects the following AI/ML architecture patterns: LLM chat applications, AI API proxy services, self-hosted AI assistants, internal developer AI tooling.

What is the CVSS score for CVE-2024-32965?

CVE-2024-32965 has a CVSS v3.1 base score of 8.6 (HIGH). The EPSS exploitation probability is 26.13%.

What is the AI security impact?

Affected AI Architectures

LLM chat applicationsAI API proxy servicesself-hosted AI assistantsinternal developer AI tooling

MITRE ATLAS Techniques

AML.T0006Active Scanning

AML.T0034Cost Harvesting

AML.T0040AI Model Inference API Access

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.4

NIST AI RMF: MANAGE-2.2

OWASP LLM Top 10: LLM06, LLM07

What are the technical details?

Original Advisory

Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive information. The jwt token header X-Lobe-Chat-Auth strored proxy address and OpenAI API Key, can be modified to scan an internal network in the target lobe-web environment. This issue has been addressed in release version 1.19.13 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Exploitation Scenario

An unauthenticated attacker discovers an internet-exposed Lobe Chat instance. They craft a POST request to the chat API with a modified X-Lobe-Chat-Auth JWT where the proxy field is replaced with http://169.254.169.254/latest/meta-data/ (AWS IMDS endpoint). Lobe Chat's backend forwards the request server-side and returns cloud IAM credentials in the response — full account takeover potential in one unauthenticated request. In parallel, the attacker decodes any intercepted legitimate JWT tokens to extract the embedded OpenAI API key, immediately usable for high-volume LLM queries billed to the victim or resold. With internal connectivity established, the attacker pivots to enumerate databases, internal APIs, or service meshes not otherwise reachable from the internet.

Weaknesses (CWE)

CWE-918Server-Side Request Forgery

CWE-918 — Server-Side Request Forgery: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

[Implementation, Operation] If there is a known list of applications, IP, hostname, and/or domains to which the product is allowed to communicate, then use allowlists to ensure that outgoing requests are restricted to these known entities. The allowlists could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].
[Implementation, Operation] If the product is expected to be able to connect to arbitrary IP addresses or domains, consider using a denylist that includes private network addresses, internal domain names, etc. The denylist could be in the application code or possibly enforced by firewalls or network segmentation [REF-1511].

Source: MITRE CWE corpus.