CyberRota Analysis
AI-GeneratedOpenMAIC versions prior to 1.0.1 are vulnerable to server-side request forgery (SSRF) due to inadequate validation in non-production builds, enabling unauthenticated attackers to exploit this flaw. By manipulating the x-base-url header or baseUrl parameter, attackers can access sensitive cloud instance metadata and credentials, potentially leading to unauthorized access to cloud resources. Organizations using affected versions in non-production environments should prioritize remediation to mitigate the risk of credential exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via the x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.