CyberRota Analysis
AI-GeneratedA server-side request forgery vulnerability exists in Next AI Draw.io versions up to 0.4.16, specifically in the POST /api/parse-url endpoint, where inadequate hostname validation allows attackers to bypass restrictions and access internal HTTP services. This flaw can lead to unauthorized data exfiltration, including sensitive cloud metadata. Organizations using this software should prioritize remediation to protect against potential exploitation by unauthenticated attackers.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Next AI Draw.io through 0.4.16 contains a server-side request forgery vulnerability in the POST /api/parse-url endpoint due to hostname validation that only checks string patterns without DNS resolution. Unauthenticated attackers can supply hostnames that bypass string validation but resolve to internal addresses, allowing them to reach arbitrary internal HTTP services and exfiltrate responses including cloud metadata.