CVE-2024-32964

CVE-2024-32964 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Lobe Chat versions prior to 0.150.6. This flaw allows an unauthenticated attacker to craft malicious requests to the /api/proxy endpoint, enabling them to access internal network services and potentially exfiltrate sensitive information. The vulnerability has a CVSS score of 9.0 (Critical), indicating a network-exploitable attack with low complexity and high impact on confidentiality, integrity, and availability. Its EPSS score of 0.675710000 suggests a high probability of exploitation. While there is no evidence of active exploitation in the wild (KEV: No), a Nuclei template for this SSRF vulnerability exists, indicating readily available exploit code. There is currently no significant community discussion or media coverage surrounding this CVE.