SSRF Bypass in New API via Hostname Resolution

Executive Summary

This vulnerability exists in the New API, a large language model gateway and AI asset management system. Before version 0.12.0-alpha.1, the default Server-Side Request Forgery (SSRF) protection did not apply IP filtering to hostnames. Specifically, the configuration option ApplyIPFilterForDomain was disabled by default, meaning that while URL validation checked domain allow/block rules, it did not resolve hostnames to validate their IP addresses. As a result, authenticated users could configure notification URLs (such as Webhook, Bark, or Gotify) that pointed to internal or metadata IP addresses, potentially allowing unauthorized access to internal network resources.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow authenticated users to bypass intended network restrictions by configuring notification URLs that point to internal or metadata IP addresses. This could lead to unauthorized access to internal services or sensitive metadata endpoints, potentially exposing sensitive information or enabling further attacks within the internal network.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade New API to version 0.12.0-alpha.1 or later, where the issue is fixed.

Additionally, ensure that the ApplyIPFilterForDomain setting is enabled to apply IP filtering to hostnames, preventing authenticated users from configuring notification URLs that point to internal or metadata IP addresses.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows authenticated users to configure URLs that point to internal or metadata IP addresses, potentially exposing sensitive internal data through timing, errors, or response-dependent behavior.

Such exposure of sensitive internal data could lead to non-compliance with data protection regulations like GDPR or HIPAA, which require strict controls to prevent unauthorized access or disclosure of sensitive information.

Mitigations such as upgrading to the fixed version, enabling IP filtering, restricting notification domains, or enforcing network-level filtering help reduce the risk of data exposure and support compliance efforts.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Server-Side Request Forgery (SSRF) due to insufficient IP filtering on hostnames in notification URLs configured by authenticated users. Detection can focus on identifying unauthorized or suspicious internal or metadata IP address requests originating from the affected system.

To detect exploitation attempts or presence of this vulnerability on your network or system, you can monitor outgoing HTTP requests from the new-api server to internal IP ranges or metadata IP addresses.

• Use network monitoring tools like tcpdump or Wireshark to capture outgoing traffic and filter for internal IP ranges (e.g., 169.254.169.254 for metadata service, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). Example command: tcpdump -i eth0 dst net 10.0.0.0/8 or dst host 169.254.169.254
• Check application logs for configured notification URLs (Webhook, Bark, Gotify) that point to internal or metadata IP addresses.
• If you have access to the new-api system, verify the configuration setting ApplyIPFilterForDomain is enabled. You can check configuration files or environment variables depending on your deployment.
• Use curl or wget commands to test if internal IP addresses are reachable from the server, which may indicate potential SSRF exploitation paths. For example: curl http://169.254.169.254/latest/meta-data/

Useful 0 Not Useful 0