CVE-2024-11603
Server-Side Request Forgery in lm-sys/fastchat
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Server-Side Request Forgery in lm-sys/fastchat
A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.
Reserved 2024-11-21 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-918 Server-Side Request Forgery (SSRF)
huntr.com/bounties/89f1158d-4a75-4000-a1bd-f82dd1a62bff
Support options
