CVE-2024-12376

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12376
A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lm-sys:fastchat:2024-10-05:*:*:*:*:*:*:*
History

31 Jul 2025, 14:37

Type Values Removed Values Added
CPE cpe:2.3:a:lm-sys:fastchat:2024-10-05:*:*:*:*:*:*:*
First Time Lm-sys
Lm-sys fastchat
Summary
  • (es) Se identificó una vulnerabilidad de Server-Side Request Forgery (SSRF) en el servidor web lm-sys/fastchat, concretamente en la versión git 2c68a13 afectada. Esta vulnerabilidad permite a un atacante acceder a recursos y datos internos del servidor que de otro modo serían inaccesibles, como las credenciales de metadatos de AWS.
References () https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892 - () https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892 - Exploit, Third Party Advisory

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-31 14:37

NVD link : CVE-2024-12376

Mitre link : CVE-2024-12376

CVE.ORG link : CVE-2024-12376

JSON object : View

Products Affected

lm-sys

  • fastchat
CWE
CWE-918

Server-Side Request Forgery (SSRF)