CVE-2024-11171
📋 TL;DR
This vulnerability allows unauthenticated attackers to crash LibreChat servers by uploading large files, causing denial of service through out-of-memory errors. All instances using default multer in-memory storage configuration are affected. The issue affects anyone running vulnerable versions of LibreChat.
💻 Affected Systems
- danny-avila/librechat
📦 What is this software?
Librechat by Librechat
⚠️ Risk & Real-World Impact
Worst Case
Complete server crash and denial of service, potentially requiring manual restart and causing extended downtime.
Likely Case
Server becomes unresponsive or crashes when attackers upload large files, disrupting service availability.
If Mitigated
Minimal impact with proper file size limits and monitoring in place.
🎯 Exploit Status
Exploitation requires only the ability to send HTTP requests with large file uploads.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.7.6
Vendor Advisory: https://github.com/danny-avila/librechat/commit/bb58a2d0662ef86dc75a9d2f6560125c018e3836
Restart Required: Yes
Instructions:
1. Update LibreChat to version 0.7.6 or later. 2. Restart the application. 3. Verify the fix by checking the version and testing file upload limits.
🔧 Temporary Workarounds
Configure multer with file size limits
allManually configure multer middleware to enforce file size limits before the official patch.
const upload = multer({ storage: storage, limits: { fileSize: 10 * 1024 * 1024 } })
Switch to disk storage
allConfigure multer to use disk storage instead of in-memory storage.
const upload = multer({ dest: 'uploads/' })
🧯 If You Can't Patch
- Implement reverse proxy or WAF rules to limit request body size
- Monitor server memory usage and set up alerts for abnormal spikes
🔍 How to Verify
Check if Vulnerable:
Check if LibreChat version is below 0.7.6 and multer is configured with in-memory storage without size limits.Check Version:
Check package.json or run: npm list librechatVerify Fix Applied:
Verify version is 0.7.6 or higher and test file uploads with sizes exceeding configured limits to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Out of memory errors
- Process crashes
- Large file upload requests
- Multer error messages
Network Indicators:
- Large HTTP POST requests to upload endpoints
- Abnormal request patterns with large payloads
SIEM Query:
source="application.log" ("out of memory" OR "multer" OR "upload") AND size>10000000