SSRF Bypass & Data Exfiltration in next-ai-draw-io via Provider Spoofing

Vulnerability Overview Vulnerability Name: SSRF Guard Bypass via EdgeOne/Ollama Provider Spoofing in next-ai-draw-io #749 Vulnerability Type: CWE-918: Server-Side Request Forgery (SSRF) Affected Versions: <= 0.4.13 (latest release as of discovery date) CVSS 3.1 Score: 7.5 (High) Discovery Date: 2025-03-17 Vulnerability Description: implements an SSRF protection mechanism that requires users to provide an API key when using a custom . However, this protection mechanism has exceptions, allowing attackers to bypass SSRF protections by setting the header to or . Attackers can completely bypass the SSRF protection and send the complete AI system prompt and all user message content to a URL controlled by the attacker. Impact Scope 1. System Prompt Leakage (Confidentiality - High): - The server's complete AI system prompt is sent to an attacker-controlled endpoint, containing the application's core instructions, tool definitions, input/output format specifications, validation rules and constraints, references to all shape libraries, etc. - Attackers can clone the application's AI behavior, understand internal validation rules to create more effective attacks, and extract proprietary diagram generation techniques. 2. User Data Exfiltration (Confidentiality - High): - All user messages and the current conversation's diagram XML are forwarded to the attacker. If users discuss confidential business processes, architectural designs, or organizational structures, this data will be fully exposed. 3. SSRF to Internal Services (Confidentiality - Medium): - By pointing to internal network addresses, attackers can probe internal services. Although the request format is fixed (POST to with a JSON body), any path on the internal service that accepts POST requests may be discovered or exploited. 4. No API Key Leakage: - The provider uses a hardcoded virtual API key ("edgeone"). The server's real AI provider API keys (OpenAI, Anthropic, etc.) are not leaked through this vulnerability. Remediation 1. Strengthen SSRF Protection Mechanism: - Ensure that when using a custom , not only is the presence of an API key checked, but the validity of the header is also verified. - For and providers, add additional validation steps to ensure they indeed originate from legitimate EdgeOne Pages deployments or legitimate Ollama users. 2. Restrict Internal Service Access: - Configure server firewall rules to block outbound connections from the server to internal network addresses. - Implement strict access control on internal services to ensure only authorized services can access them. 3. Enhance Logging and Monitoring: - Log all SSRF-related requests, especially those involving custom s. - Set up alerting mechanisms to immediately notify the security team when abnormal SSRF requests are detected. POC Code 5.2 PoC 1: Start HTTP Listener (Simulating Attacker Server) 5.3 PoC 2: Send SSRF Bypass Request 5.5 PoC 3: Ollama Provider Bypass (Alternative Vector) 5.6 PoC 4: Verification Script

Goal Reached Thanks to every supporter — we hit 100%!

SSRF Bypass & Data Exfiltration in next-ai-draw-io via Provider Spoofing

More from this source