CyberRota Analysis
AI-GeneratedA server-side request forgery (SSRF) vulnerability in the duhow/xiaoai-patch allows remote attackers to exploit the Xiaomi smart speaker by sending crafted HTTP requests to arbitrary internal or external URLs. This flaw can lead to unauthorized access to internal services and network scanning, posing a significant risk to the security of affected networks. Organizations using this product should prioritize remediation to mitigate potential exposure to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.