NextChat Open Proxy: Unauthenticated SSRF via x-base-url Leaks OpenAI API Key

Key Vulnerability Information Summary Vulnerability Overview Title: Server OpenAI API Key Exfiltration via Incomplete URL Substring Check in Proxy Handler ID: #6814 Type: Security vulnerability (Bug) Status: Open Description: The proxy handler uses a substring check to determine whether to inject the configured into the outgoing request headers. Because this check is a simple string inclusion test, an attacker can craft a URL containing (e.g., or ) to cause the server to inject the API key and forward it to an attacker-controlled domain, and this can be triggered without authentication. Scope of Impact Deployment Method: Docker Version: v2.16.1 Operating System: Other Browser: Other Impact: An unauthenticated attacker can steal the deployer’s by sending a single HTTP request (with a crafted header), and can call any OpenAI API under the deployer’s name, leading to cost losses. Access controls do not mitigate this issue. Affected Objects: Any NextChat deployment configured with (a common configuration for self-hosted instances). POC Code Prerequisites: A running NextChat instance with configured, using the Docker image. Listener (logs incoming request headers): Send unauthenticated request (crafted x-base-url): Content received by the attacker’s server: Remediation Correct approach: The parsed hostname should be compared rather than using substring matching: Covered by: Fixed in PR #6813 for the same proxy handler, replacing substring matching with exact hostname matching (hostname-exact OpenAI key injection instead of substring match). Related security hardening PRs: - #6813: Unauthenticated SSRF via Open Proxy (based on header) - #6813: [Security] harden open proxy fallback against SSRF and key leak - #6813: [Security] harden open proxy x-base-url against key leak and SSRF

Goal Reached Thanks to every supporter — we hit 100%!

NextChat Open Proxy: Unauthenticated SSRF via x-base-url Leaks OpenAI API Key

More from this source