CVE-2024-12580: Logs Debug Injection in danny-avila/librechat
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and fileid in the /code/download/:sessionId/:fileId and /download/:userId/:fileid APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-12580?
CVE-2024-12580 is considered a medium-severity vulnerability due to its potential for log injection.
How do I fix CVE-2024-12580?
To fix CVE-2024-12580, upgrade to LibreChat version 0.7.6 or later where the vulnerability is addressed.
What vulnerable parameters are associated with CVE-2024-12580?
CVE-2024-12580 affects the parameters sessionId, fileId, userId, and file_id in the specified API endpoints.
What impact can CVE-2024-12580 have on my application?
CVE-2024-12580 may allow an attacker to inject harmful data into application logs, which could lead to further exploitation.
Is CVE-2024-12580 exploitable remotely?
Yes, CVE-2024-12580 can be exploited remotely through the affected API endpoints if proper validation is not enforced.