Drupal OpenAI Provider Module Vulnerable to Server-Side Request Forgery and Local File Read (CVE-2026-13233)

A public exploit has been released on Sploitus for CVE-2026-13233, a moderately critical Server-Side Request Forgery (SSRF) vulnerability affecting the Drupal OpenAI Provider (ai_provider_openai) module. This flaw arises from insufficient input validation, where the module fetches URLs contained in the upstream API response without proper scheme allowlisting. An attacker can compromise or configure a malicious upstream AI API proxy/gateway to respond with crafted URLs, including file:// schemes or internal network addresses. This allows for sensitive local file reads, such as /etc/hostname or settings.php (potentially exposing database credentials), and can facilitate access to internal network services like cloud instance metadata endpoints (e.g., 169.254.169.254). While the publicly released reproducer is "safe" and sandbox-only, the availability of detailed technical information and a confirmed defect mechanism significantly elevates the risk for unpatched Drupal deployments, which remain vulnerable in the wild. The vulnerability was reported privately and fixed in versions 1.1.1 and 1.2.2.

Attack Chain

1. An attacker compromises or controls an AI API proxy/gateway configured as the upstream for a vulnerable Drupal OpenAI Provider module.
2. The attacker initiates an image generation or similar request via the Drupal module, which triggers a call to the configured upstream AI API.
3. The vulnerable Drupal OpenAI Provider module sends a request to the attacker-controlled upstream AI API.
4. The attacker-controlled upstream API responds with a specially crafted URL (e.g., file:///path/to/sensitive/file or http://internal-ip/service) embedded within its response.
5. The Drupal OpenAI Provider module, lacking proper scheme allowlisting, attempts to fetch content from the crafted URL provided in the upstream response.
6. The Drupal server performs a local file read (e.g., /etc/hostname, settings.php, /etc/passwd) or an internal network request (SSRF) using the module's privileges.
7. The content of the sensitive file or the response from the internal service is retrieved by the Drupal module.
8. The attacker then extracts the sensitive information (e.g., database credentials, internal network configuration) from the Drupal module's processing output or logs.

Impact

Successful exploitation of CVE-2026-13233 leads to significant information disclosure. Attackers can read arbitrary local files on the Drupal server, including critical configuration files like settings.php, which often contain database credentials, API keys, and other sensitive information. Furthermore, the SSRF capability allows access to internal network resources, potentially exposing cloud instance metadata (e.g., AWS IMDS 169.254.169.254), internal services, or other systems not directly exposed to the internet. This could enable further lateral movement or privilege escalation within the compromised environment. The vulnerability is rated "moderately critical" by Drupal, indicating a significant risk to confidentiality.

Recommendation

• Immediately update the Drupal OpenAI Provider module to version 1.1.1 or 1.2.2 to patch CVE-2026-13233.
• Deploy the Detect Potential Drupal OpenAI Provider SSRF to IMDS or RFC1918 Sigma rule to your SIEM to identify anomalous outbound network connections from web server processes to internal IP ranges.
• Deploy the Detect Drupal OpenAI Provider Local File Read of Sensitive Files Sigma rule to your SIEM to detect web server processes attempting to read sensitive system or configuration files like settings.php or /etc/hostname.
• Enable comprehensive host auditing (e.g., auditd on Linux, EDR) to monitor and log sensitive file access attempts by web processes.
• Ensure proxy and EDR solutions are configured to log and alert on egress to 169.254.169.254 and RFC1918 ranges, especially when originating from web server processes.
• Implement enhanced application audit logging for AI integrations to record {request_id, actor, target_url, scheme, resolved_ip, content_type} for all fetch operations.