Description

In danny-avila/librechat version v0.7.5-rc2, a vulnerability exists in the preset creation functionality where a user can manipulate the user ID field through mass assignment. This allows an attacker to inject a different user ID into the preset object, causing the preset to appear in the UI of another user. The vulnerability arises because the backend saves the entire object received without validating the attributes and their values, impacting both integrity and confidentiality.

INFO

Published Date :

2025-03-20T10:10:44.510Z

Last Modified :

2025-03-20T18:17:28.379Z

Source :

@huntr_ai
AFFECTED PRODUCTS

The following products are affected by CVE-2024-10359 vulnerability.

Vendors Products
Librechat
  • Librechat
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2024-10359.

URL Resource
https://github.com/danny-avila/librechat/commit/e3e52402f69accc35c6d0acd9c3266ae1cb6333f cve-icon cve-icon
https://huntr.com/bounties/bba65eb4-4c83-4f33-83c1-ede5ed0d5656 cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact