SSRF Vulnerability in ChatGPTNextWeb NextChat

ChatGPTNextWeb NextChat versions up to and including 2.16.1 contain a server-side request forgery (SSRF) vulnerability. The flaw exists within the proxyHandler function located in app/api/proxy.ts, specifically within the component responsible for proxy fallback handling. By manipulating the 'x-base-url' HTTP header, an unauthenticated remote attacker can force the application server to make arbitrary requests to internal or external resources. This can potentially expose sensitive internal services, metadata endpoints, or infrastructure otherwise protected by network boundaries. While a fix has been proposed via pull request, it remains pending acceptance at the time of reporting. Organizations utilizing NextChat should monitor for suspicious outbound traffic patterns originating from the server hosting the application until an official patch is verified and deployed.

Impact

Successful exploitation of this SSRF vulnerability permits unauthorized interaction with resources reachable by the application server. This could lead to information disclosure, unauthorized access to internal management interfaces, or service disruption. As the vulnerability is remotely exploitable without authentication, it poses a significant risk to the integrity of internal network segments hosting the application.

Recommendation

• Monitor HTTP traffic for unexpected requests originating from the NextChat application server to sensitive internal IP ranges or cloud metadata services (e.g., 169.254.169.254).
• Restrict the application server's outbound network access to only necessary external endpoints via egress firewall rules.
• Review the pending security patches provided by the project maintainers and update to a remediated version once finalized and released.