未評価
Logs Debug Injection in danny-avila/librechat
CVE-2024-12580
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and file_id in the /code/download/:sessionId/:fileId and /download/:userId/:file_id APIs are not validated or filtered, leading to potential log injection attacks. This can cause distortion of monitoring and investigation information, evade detection from security systems, and create difficulties in maintenance and operation.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web huntr.com