Skip to content
Nuclei Templates

FastChat - Open Redirect

ID: CVE-2024-10908

Severity: medium

Author: DhiyaneshDK

Tags: cve,cve2024,fastchat,redirect,oss,chatbot,areana

Description

Section titled “Description”

Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs.

YAML Source

Section titled “YAML Source”
id: CVE-2024-10908


info:
  name: FastChat - Open Redirect
  author: DhiyaneshDK
  severity: medium
  description: |
    Detects an open redirect vulnerability in lm-sys/fastchat version 0.2.36, which allows attackers to redirect users to malicious URLs.
  reference:
    - https://huntr.com/bounties/61f5e725-5579-4d08-8a88-e4ba04e6d1f2
  metadata:
    shodan-query: html:"Chatbot Arena"
    verified: true
    max-request: 1
  tags: cve,cve2024,fastchat,redirect,oss,chatbot,areana


flow: http(1) && http(2)


http:
  - method: GET
    path:
      - "{{BaseURL}}"


    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body,"lm-sys/FastChat/")'
        internal: true


  - method: GET
    path:
      - "{{BaseURL}}/file=https://interact.sh"


    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$'
# digest: 4a0a004730450220660b263cfbff1ee5ef7ab28ca4aa0241c05f02f12e8cdd8837fb5e5d3cc4aabd0221009ec7340da1dbe80e99001b7e3d13dff83d8ee2227f7239d107c3451884e3fa5b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2024/CVE-2024-10908.yaml"

View on Github