There are advantages to using standalone AI chatbots over cloud-based alternatives such as OpenAI; however, there are also some security risks.
Research shows NextChat, a popular standalone chatbot with over 7500 exposed instances, is vulnerable to a critical SSRF vulnerability (CVE-2023-49785) that allows attackers to access internal systems and data potentially.
The vulnerability was reported to the vendor in November 2023, but with no patch available after 90 days, technical details are being publicly released.
CVE-2023-49785: A Super SSRF
NextChat, a Javascript application built with Next.js, exposes a critical vulnerability. Its core functionality runs on the client side. A server-side endpoint named “/api/cors” acts as an open proxy that allows anyone to send unauthorized requests to any external server.
Designed to enable saving chat data on WebDAV servers, this endpoint bypasses browser security measures.
Users can exploit it to access unintended resources by crafting requests that the application blindly forwards, as a user could access Google through this loophole.
A critical Server-Side Request Forgery (SSRF) vulnerability exists, allowing attackers to gain unauthorized access to internal systems and potentially the entire network. This vulnerability grants attackers the ability to:
- Reach any internal HTTP endpoint, including sensitive ones.
- Download full responses from the targeted endpoints.
- Employ various HTTP methods (POST, PUT, etc.) with custom request bodies.
- Manipulate URL parameters through encoding.
- Include authorization headers within requests.
If the application is web-accessible, an attacker can potentially compromise the entire internal network connected to the application. While limitations exist in directly injecting specific headers, potential workarounds might exist.
This vulnerability is particularly dangerous due to its extensive access capabilities and potential for sensitive data exfiltration.
Reflected XSS:
A specific reflected XSS vulnerability bypasses the need for external resources and the application’s /api/cors endpoint utilizes the fetch method, which allows the data protocol.
An attacker can inject a malicious payload into the data URL encoded in base64, which includes JavaScript code to display an alert with the website’s domain upon reaching the server.
Since the server reflects the data back to the client without proper sanitization, the script executes in the victim’s browser, resulting in a successful XSS attack.
Detection and Mitigation:
A critical vulnerability (CVE-2023-49785) exists in ChatGPT-Next-Web (versions 2.11.2 and prior) that allows attackers full read and write access to internal systems through forged requests.
It can also exploit the application as an open proxy to mask their IP and redirect malicious traffic.
According to the Horizon3ai timeline for vulnerability disclosure:
- Nov. 25, 2023: Horizon3 reports security issue to ChatGPT-Next-Web via GitHub vulnerability disclosure process
- Nov. 26, 2023: Vendor accepts the report
- Dec. 6, 2023: GitHub CNA reserves CVE-2023-49785
- Jan. 15, 2024: Horizon3 asks vendors for an update using the GitHub security issue. No response.
- Mar. 7, 2024: Horizon3 asks vendors for an update using the GitHub security issue. No response.
- Mar. 11, 2024: Public disclosure
Avoid using this software online. If internet exposure is unavoidable, a secure, isolated network without internal resource access is needed. Even in isolation, attackers might use the software as an open proxy to hide malicious traffic targeting other systems.
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.
