Disk Space Exhaustion via File Upload in LibreChat

Detection Guidance

This vulnerability involves the ability of an authenticated user to upload arbitrarily large files to the /api/convos/import endpoint in LibreChat prior to version 0.8.4-rc1, potentially exhausting server disk space and memory.

To detect this vulnerability on your system, you can monitor for unusually large file uploads to the /api/convos/import endpoint, especially from authenticated users.

Suggested commands include using network monitoring or web server logs to identify large POST requests to this endpoint.

• Using curl to test upload size limits: curl -X POST -F "file=@largefile" https://yourserver/api/convos/import -H "Authorization: Bearer <token>" --verbose
• Using grep and awk on server logs to find large uploads: grep "/api/convos/import" /var/log/nginx/access.log | awk '{print $10, $7}' | sort -nr | head
• Using monitoring tools to track disk and memory usage spikes correlated with file uploads to the endpoint.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in LibreChat versions prior to 0.8.4-rc1. It involves the POST /api/convos/import endpoint, which uses a separate file upload handler that was not updated with file size limits. While other parts of the application had limits to restrict file upload sizes, this endpoint did not enforce such limits. Additionally, the application-level size check is disabled by default. As a result, an authenticated user can upload arbitrarily large files, potentially exhausting the server's disk space and memory.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated user to upload very large files without restriction, which can lead to exhaustion of server disk space and memory. This can cause denial of service conditions, degrade server performance, or potentially crash the application, impacting availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade LibreChat to version 0.8.4-rc1 or later where the issue is fixed.

Ensure that the POST /api/convos/import endpoint uses a multer instance configured with file size limits similar to those applied in other file upload routes.

Verify that the environment variable CONVERSATION_IMPORT_MAX_FILE_SIZE_BYTES is set to an appropriate value to enable application-level size checks.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0