SSRF in Portkey AI Gateway

Portkey AI Gateway versions 1.14.0 through 1.15.2 contain a server-side request forgery (SSRF) vulnerability due to improper host validation logic within the isValidCustomHost function. When the TRUSTED_CUSTOM_HOSTS configuration variable is left unset, the application incorrectly trusts localhost-style hostnames. An unauthenticated attacker can exploit this flaw by sending a crafted HTTP request to a /v1 endpoint, specifically utilizing the x-portkey-custom-host header. By targeting loopback addresses or internal Docker host services through this header, an attacker can coerce the gateway to perform unauthorized requests on their behalf and return the resulting data from internal services back to the attacker. This vulnerability poses a significant risk to the confidentiality and integrity of internal infrastructure that is otherwise not exposed to the public internet.

Impact

Successful exploitation allows an unauthenticated attacker to interact with internal services that are only accessible from the loopback interface or within the Docker environment where the AI Gateway is hosted. This can lead to unauthorized information disclosure, interaction with internal management APIs, or potential secondary exploitation of internal microservices that assume all incoming requests are originating from trusted internal sources.

Recommendation

• Upgrade Portkey AI Gateway to a version beyond 1.15.2 immediately.
• If upgrading is not immediately possible, explicitly configure the TRUSTED_CUSTOM_HOSTS environment variable to restrict the gateway to a strict allowlist of known-safe, non-internal hostnames.
• Audit access logs for requests containing the x-portkey-custom-host header to identify potential exploitation attempts directed at internal loopback (127.0.0.1) or private Docker host IP addresses.