Remote Reference Resolver Flaw in FastGPT Allows Internal Service Access

Compliance Impact

The vulnerability allows an authenticated team member to perform Server-Side Request Forgery (SSRF) attacks that can expose internal services or cloud metadata, including sensitive data such as cloud instance metadata and IAM credentials.

This exposure of sensitive internal information could lead to unauthorized access or data breaches, which may impact compliance with data protection regulations like GDPR or HIPAA that require safeguarding sensitive and personal data.

Since the vulnerability enables data exfiltration through SSRF, organizations using affected versions of FastGPT may face increased risk of non-compliance with standards mandating strict access controls and data confidentiality.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability allows an authenticated team member to read internal services or cloud metadata that should normally be protected. This can lead to unauthorized disclosure of sensitive internal information, potentially exposing infrastructure details or cloud environment metadata that could be leveraged for further attacks or data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, upgrade FastGPT to version 4.15.0-beta4 or later, where the issue has been fixed.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in FastGPT, a knowledge-based AI application platform, in versions prior to 4.15.0-beta4. The issue arises because the HTTP-tool OpenAPI schema importer only validates the top-level URL before passing it to SwaggerParser.bundle. The remote reference resolver in SwaggerParser.bundle fetches $ref URLs without applying FastGPT's internal-address guard. As a result, an authenticated team member can exploit this to read internal services or cloud metadata by having the fetched content returned inline.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves Server-Side Request Forgery (SSRF) through the OpenAPI schema importer in FastGPT, where malicious $ref URLs can cause the server to fetch internal or cloud metadata endpoints. Detection involves monitoring for unusual outbound HTTP requests initiated by the FastGPT server to internal IP ranges or cloud metadata endpoints.

You can detect exploitation attempts by checking server logs for requests to the OpenAPI schema import endpoint that include suspicious $ref URLs referencing internal IP addresses (e.g., 169.254.169.254 for AWS metadata) or private IP ranges.

Suggested commands to detect potential exploitation attempts include:

• Using grep or similar tools to search FastGPT server logs for OpenAPI schema import requests containing suspicious $ref URLs:
• grep -i '\$ref' /path/to/fastgpt/logs/* | grep -E '169\.254\.169\.254|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.'
• Monitoring outgoing HTTP requests from the FastGPT server to internal IP ranges using network tools like tcpdump or Wireshark:
• sudo tcpdump -i eth0 host 169.254.169.254 or net 10.0.0.0/8 or net 172.16.0.0/12 or net 192.168.0.0/16
• Checking for unusual or unexpected HTTP requests initiated by FastGPT processes using system monitoring tools or proxy logs.

Since the vulnerability requires an authenticated user to submit a malicious OpenAPI schema, auditing user activity and schema import requests for anomalies is also recommended.

Useful 0 Not Useful 0