Chatbots based on large language models (LLMs) have now become an integral part of everyday work in many organisations. However, they raise a problem: how can employees use LLM systems in a way that respects data protection?
Many companies rely on LibreChat, a popular open-source platform with around 33,000 GitHub stars, which makes various language models (including self-hosted ones) available via a unified interface.
During a penetration test of a LibreChat-based application, we discovered a security vulnerability in LibreChat that had gone undetected for over two years. It grants unauthorised parties unrestricted read access to conversations and thus poses specific risks to data protection, compliance and the confidentiality of sensitive data.
LibreChat is frequently used in organisations to provide staff with an AI-based chat platform featuring a data protection-compliant infrastructure. This often results in chats containing:
The vulnerability results in:
The vulnerability lies in the test endpoint /api/search/test, which is exposed and inadequately secured in the default configuration of LibreChat. Using a simple GET request, attackers can retrieve all chat data, regardless of whether they created the chat themselves. A filter parameter (q=...) even allows targeted searches for terms such as ‘password’ or ‘secret’.
GET /api/search/test?q=secrets
Host: <Host>
Authorization: Bearer <Token>
[
{
"_id": "<Redacted>",
"text": "==I will tell you some <em>secrets</em> now: Parrots are my favourite animal!==",
"conversationId": "<redacted>",
"searchResult": true
}
]
The direct fix is already available in versions >= v0.7.8: Organisations should definitely upgrade to this version, as the relevant commit removes the inadequately secured endpoint.
Systems that cannot be updated immediately should disable the endpoint by manually blocking it via a reverse proxy configuration or a web application firewall (WAF).
The vulnerability can be identified by a targeted analysis of the system logs. As the endpoint /api/search/test is not accessed during normal use of LibreChat, any access to this endpoint constitutes an unusual event that requires attention.
Although the patch was already available at the time the vulnerability was reported to LibreChat, the vulnerability was fixed quietly and without transparency. The release note merely mentioned“simplify logic in search/enable endpoint”(Commit: 0e8041b).
Publishing this as a CVE clearly communicates its security significance. This enables organisations to prioritise the vulnerability and check whether they are affected.
Do you have any questions or need assistance?
At iteratec, we place great importance on security. With expertise such as application penetration testing, we help companies to systematically identify, prioritise and rectify vulnerabilities. Our reports not only contain reproducible, step-by-step analyses, but also specific recommendations on how development teams can improve the security of their applications in the long term.