CVE-2024-11603CWE-918

Server-Side Request Forgery in lm-sys/fastchat

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00700 · 52.7th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Server-Side Request Forgery in lm-sys/fastchat
    cvelistv5