GHSA-h254-g997-685c

FastChat Server-Side Request Forgery vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2024-11603

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	fschat	<= 0.2.36	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2024-11603 advisory
https://github.com/lm-sys/FastChat package
https://huntr.com/bounties/89f1158d-4a75-4000-a1bd-f82dd1a62bff web