CVE-2024-11603 - CVE House
Back to Database
Status published High CVE-2024-11603

Server-Side Request Forgery in lm-sys/fastchat

Vulnerability Description

A Server-Side Request Forgery (SSRF) vulnerability exists in lm-sys/fastchat version 0.2.36. The vulnerability is present in the `/queue/join?` endpoint, where insufficient validation of the path parameter allows an attacker to send crafted requests. This can lead to unauthorized access to internal networks or the AWS metadata endpoint, potentially exposing sensitive data and compromising internal servers.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-11603

Credits & Attribution

No credits recorded in the NVD database.

References

More from lm-sys

View All →
CVE-2025-3677
lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization
Medium 4.8
CVE-2024-12376
Server Side Request Forgery in lm-sys/fastchat
High 7.5
CVE-2024-10912
Denial of Service in lm-sys/fastchat
High 7.5
CVE-2024-10908
Open Redirect in lm-sys/fastchat
Medium 6.1
CVE-2024-10907
Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchat
High 7.5

Affected Vendor

Affected Software

lm-sys/fastchat
Vulnerable Versions:
unspecified

Timeline

Official Publish: March 20th, 2025
Last Modified: March 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-918

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1005 Data from Local System
Collection
T1046 Network Service Discovery
Discovery