CyberRota Analysis
AI-GeneratedThe Kiro API-key validation endpoint in versions prior to 0.5.6 of 9Router is vulnerable to an attacker-controlled upstream URL manipulation due to improper validation of the user-supplied region value. This flaw allows authenticated attackers to redirect Kiro validation requests to malicious hosts, potentially exposing sensitive API keys. Organizations using affected versions of 9Router should prioritize upgrading to version 0.5.6 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router is an AI router & token saver. Prior to 0.5.6, the Kiro API-key validation endpoint POST /api/oauth/kiro/api-key builds an upstream URL using a user-controlled region value, allowing an authenticated attacker to supply a crafted region such as kiro-canary.local:8443# and cause 9Router to send the Kiro validation request to an attacker-controlled host while forwarding the submitted Kiro API key as an Authorization header. This issue is fixed in version 0.5.6.