CyberRota Analysis
AI-GeneratedIn Dradis Community Edition, a flaw in the ProvidersController and AgentsController allows authenticated non-admin users to bypass authorization checks, enabling them to create AI providers that point to arbitrary HTTP/HTTPS addresses. This vulnerability can lead to server-side request forgery (SSRF), where the server makes requests to attacker-supplied URLs, potentially exposing sensitive information through reflected error messages. Organizations using Dradis Community Edition should prioritize addressing this vulnerability to protect against unauthorized access and data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
In Dradis Community Edition, the ProvidersController and AgentsController gate their admin_required before_action on `defined?(Dradis::Pro)`, a constant that is never defined in CE, so the authorization check is never applied. As a result, any authenticated (non-admin) user can create an AI provider pointing to an arbitrary HTTP/HTTPS address (including internal/link-local hosts such as http://169.254.169.254) and reassign the built-in Roslin agent to use it. When an AI interaction is triggered, the server issues a request to the attacker-supplied URL (server-side request forgery). For non-2xx responses, the target's response body is reflected verbatim to the attacker's browser via ActionCable/Turbo Stream error messages, making the SSRF readable.