CyberRota Analysis
AI-GeneratedThe vulnerability affects the New API large language model gateway and AI asset management system, specifically prior to version 0.12.0-alpha.1, where the default SSRF protection did not enforce IP filtering for hostnames. This oversight allows authenticated users to set notification URLs that could target internal or sensitive IP addresses, potentially leading to unauthorized access to internal resources. Organizations using this system should prioritize upgrading to the latest version to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 0.12.0-alpha.1, the default SSRF protection configuration did not apply IP filtering to hostnames; with ApplyIPFilterForDomain disabled by default, URL validation checked domain allow/block rules but did not resolve a hostname and validate the resolved IP address, allowing authenticated users to configure Webhook, Bark, or Gotify notification URLs that point at an internal or metadata IP address. This issue is fixed in version 0.12.0-alpha.1.
Related CVEs
Other vulnerabilities affecting the same vendor(s)