Executive Summary

This vulnerability exists in FastGPT, an AI Agent building platform, prior to version 4.14.17. It involves an inconsistent Server-Side Request Forgery (SSRF) protection gap in the MCP tool URL handling. While some endpoints rejected internal or private network URLs, the create and update endpoints for MCP tools could still save internal URLs. An authenticated user with permission to create or manage MCP toolsets could store an internal endpoint URL, such as http://localhost:3000/mcp, which could later be used by the backend workflow runner to connect to that internal destination without revalidating the URL.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an authenticated user with certain permissions to cause the FastGPT backend to connect to internal network endpoints that are normally inaccessible. This could lead to unauthorized access to internal services, potential data leakage, or exploitation of internal systems. The CVSS score of 6.3 indicates a medium severity with impacts on confidentiality, integrity, and availability.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FastGPT to version 4.14.17 or later, where the SSRF protection gap has been patched.

Additionally, restrict permissions so that only trusted authenticated users can create or manage MCP toolsets, minimizing the risk of storing malicious internal URLs.

Useful 0 Not Useful 0