CyberRota Analysis
AI-GeneratedObot versions prior to 0.23.0 are vulnerable to a server-side request forgery (SSRF) flaw that allows privileged users to send requests to arbitrary URLs without proper validation. This vulnerability can be exploited by attackers with Power User or higher roles to access internal services and cloud metadata endpoints, potentially exposing sensitive credentials through error message disclosures. Organizations using Obot should prioritize patching this vulnerability to mitigate the risk of credential leakage and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify arbitrary URLs without destination validation. Attackers with Power User or higher roles can coerce Obot to make requests to internal services and cloud metadata endpoints, reading responses in error messages to disclose sensitive credentials.