GHSA-g44m-hpf4-vmrp

FastChat Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-12376

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	fschat	<= 0.2.36	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Server-Side Request Forgery (SSRF) vulnerability was identified in the lm-sys/fastchat web server, specifically in the affected version git 2c68a13. This vulnerability allows an attacker to access internal server resources and data that are otherwise inaccessible, such as AWS metadata credentials.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-12376 advisory
https://github.com/lm-sys/FastChat package
https://huntr.com/bounties/c9cc3f28-ee9f-4d2d-9ee5-8c6455a11892 web