| tiêu đề | decolua 9router 0.5.55 Server-Side Request Forgery |
|---|
| Mô tả | A vulnerability has been found in 9Router (an open-source local AI routing gateway, npm packages 9router/9router-app), up to version 0.5.55. The vulnerability exists in the /v1/search endpoint, where the client can override the search provider's service address via the provider_options.baseUrl parameter. The server subsequently makes a fetch() request to this user-supplied URL. Although the project implements SSRF protection (src/shared/utils/ssrfGuard.js), it contains multiple bypasses: DNS resolution is not performed, allowing loopback-resolving domains such as nip.io and localtest.me to pass; IPv6-mapped addresses like [::ffff:127.0.0.1] bypass detection due to URL normalization; a trailing dot (localhost.) avoids suffix matching; and redirects are followed by default without re-validation. An authenticated attacker (or unauthenticated in default requireApiKey=false deployments) can exploit these bypasses to send requests to arbitrary internal/loopback addresses. Additionally, loopback requests made by the server are marked by the middleware as trusted local sources (isLocalRequest=true), granting access to local /v1/* endpoints without credentials. The attack can also exfiltrate API keys of configured search providers via request headers. |
|---|
| Nguồn | ⚠️ https://github.com/decolua/9router/issues/3714 |
|---|
| Người dùng | CAPT (UID 100253) |
|---|
| Đệ trình | 02/09/2026 11:33 (cách đây 29 ngày) |
|---|
| Kiểm duyệt | 30/09/2026 21:06 (28 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 412342 [decolua 9Router đến 0.5.55 Search Endpoint ssrfGuard.js fetch provider_options.baseUrl nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|