CVE-2024-12376

Advisory

Affected versions of the lm-sys FastChat package are vulnerable to Server-Side Request Forgery (SSRF). The web server functionality fails to properly validate and sanitize user-supplied URL parameters, leading to unauthorized access to internal resources. An unauthenticated attacker can exploit this vulnerability by crafting malicious requests to internal endpoints such as the AWS EC2 Instance Metadata Service, resulting in the exposure of sensitive credentials, including AWS IAM access keys, secret keys, and session tokens, potentially leading to full cloud infrastructure compromise.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-g44m-hpf4-vmrp
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-12376