| Package | Affected versions | Patched versions |
|---|---|---|
| lobe chat | < 1.130.1 | 1.130.1 |
| @lobehub/chat | < 1.130.1 | 1.130.1 |
Vulnerability Overview
The project's OIDC redirect handling logic constructs the host and protocol of the final redirect URL based on the X-Forwarded-Host or Host headers and the X-Forwarded-Proto value. In deployments where a reverse proxy forwards client-supplied X-Forwarded-* headers to the origin as-is, or where the origin trusts them without validation, an attacker can inject an arbitrary host and trigger an open redirect that sends users to a malicious domain.
Vulnerable Code Analysis
const internalRedirectUrlString = await oidcService.getInteractionResult(uid, result);
log('OIDC Provider internal redirect URL string: %s', internalRedirectUrlString);
let finalRedirectUrl;
try {
finalRedirectUrl = correctOIDCUrl(request, new URL(internalRedirectUrlString));
} catch {
finalRedirectUrl = new URL(internalRedirectUrlString);
log('Warning: Could not parse redirect URL, using as-is: %s', internalRedirectUrlString);
}
return NextResponse.redirect(finalRedirectUrl, {
headers: request.headers,
status: 303,
});
curl Example
curl -i 'http://localhost:3210/oidc/callback/desktop?code=abc&state=test123' \
-H 'X-Forwarded-Host: google.com' \
-H 'X-Forwarded-Proto: https'
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free