Attack Chain

1. An unauthenticated attacker sends an HTTP GET request to https://<host>/api/providers to list all configured provider connections, obtaining partial credentials and account IDs.
2. The attacker sends an HTTP POST request to https://<host>/api/providers with a malicious payload to create a new, attacker-controlled provider connection (e.g., {"provider":"openai","authType":"apikey","name":"rogue","apiKey":"sk-attacker-controlled"}).
3. The attacker sends an HTTP PUT request to https://<host>/api/providers/<existing-uuid> to modify an existing provider's configuration, potentially replacing legitimate API keys with their own to redirect traffic or exfiltrate data.
4. The attacker sends an HTTP DELETE request to https://<host>/api/providers/<existing-uuid> to delete critical provider connections, leading to denial of service for legitimate users.
5. The attacker sends an HTTP GET request to https://<host>/api/usage/stats to retrieve a list of all plaintext API keys, per-account usage data, and cost information.
6. The attacker sends an HTTP GET request to https://<host>/api/usage/request-logs to obtain paginated request logs containing timestamps, models, providers, and user emails.
7. The attacker retrieves individual conversation details by sending an HTTP GET request to https://<host>/api/usage/request-details/<request-uuid>, exposing full conversation turns, including system prompts and sensitive user messages.
8. The attacker leverages the stolen API keys and conversation data for further malicious activities, such as unauthorized access to AI provider accounts or social engineering.

Impact

The identified vulnerabilities have critical consequences. An attacker can add malicious providers to intercept all prompts and responses, modify existing providers to hijack legitimate traffic, or delete all providers to cause a complete denial of service. The compromise extends to a full API key leak via /api/usage/stats, enabling unauthorized use of connected AI provider accounts. Most critically, the /api/usage/request-details endpoint exposes complete conversation histories, including highly sensitive system prompts, user messages, and assistant responses, leading to severe privacy breaches and potential exfiltration of proprietary or confidential information processed by AI models.

Recommendation

• Prioritize patching 9Router instances to a version greater than 0.4.41 immediately.
• Deploy the provided Sigma rules to your SIEM solution and tune them for your environment to detect attempts to exploit these vulnerabilities against /api/providers, /api/usage/stats, and /api/usage/request-details.
• Review web server access logs for any suspicious unauthenticated POST, PUT, or DELETE requests to /api/providers endpoints as well as GET requests to /api/usage/stats or /api/usage/request-details originating from unusual IP addresses.
• Implement strong authentication and authorization controls for all sensitive API endpoints in your environment, especially those related to configuration and data access.