CVE-2024-10908
📋 TL;DR
An open redirect vulnerability in lm-sys/fastchat v0.2.36 allows attackers to redirect users to malicious websites via crafted URLs. This affects all users accessing vulnerable FastChat instances, enabling phishing, malware distribution, and credential theft attacks.
💻 Affected Systems
- lm-sys/fastchat
📦 What is this software?
Fastchat by Lm Sys
⚠️ Risk & Real-World Impact
Worst Case
Users redirected to sophisticated phishing sites that steal credentials, install malware, or compromise accounts through social engineering.
Likely Case
Phishing campaigns targeting users with legitimate-looking redirects to steal credentials or distribute malware.
If Mitigated
Limited impact with proper user awareness training and browser security controls in place.
🎯 Exploit Status
Exploitation requires only a crafted URL that users must click. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.2.37 or later
Vendor Advisory: https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2
Restart Required: Yes
Instructions:
1. Update FastChat to v0.2.37 or later using pip: 'pip install --upgrade fschat'
2. Restart the FastChat service
3. Verify the update with 'pip show fschat'
🔧 Temporary Workarounds
Input Validation Filter
allImplement server-side validation to reject URLs with external domains in redirect parameters
# Add URL validation in FastChat's web handlers
# Example Python snippet:
import re
from urllib.parse import urlparse
def validate_redirect_url(url):
parsed = urlparse(url)
allowed_domains = ['yourdomain.com', 'localhost']
return parsed.netloc in allowed_domains or not parsed.netloc
🧯 If You Can't Patch
- Implement WAF rules to block requests with external URLs in redirect parameters
- Deploy browser security extensions that warn about open redirects and educate users about phishing risks
🔍 How to Verify
Check if Vulnerable:
Test by accessing a crafted URL like 'http://fastchat-instance/redirect?url=http://malicious.com' and checking if redirect occursCheck Version:
pip show fschat | grep VersionVerify Fix Applied:
After patching, test the same crafted URL - it should either block the redirect or show an error📡 Detection & Monitoring
Log Indicators:
- HTTP requests with external domains in URL parameters
- Unusual redirect patterns in access logs
Network Indicators:
- Multiple redirects to external domains from single IP
- Suspicious referrer headers
SIEM Query:
source="fastchat.log" AND (url="*redirect*" OR url="*url=*" OR url="*http://*")