An authenticated server-side request forgery vulnerability in QuantumNous new-api allows registered users to perform unauthorized requests to arbitrary services, posing a significant risk to internal network security.

The application suffers from a server-side request forgery (SSRF) flaw (CWE-918) where the system fails to validate user-supplied URLs before processing them. This vulnerability is accessible to any authenticated user, including those who have registered via default settings, enabling them to force the server to interact with arbitrary network locations.

Successful exploitation of this SSRF vulnerability allows an attacker to bypass perimeter security, potentially accessing sensitive internal services, metadata APIs, or non-public network infrastructure. Given the CVSS score of 8.5, this is considered a high-severity issue that could lead to lateral movement, data exfiltration, or reconnaissance of the internal environment.

Immediate Action: Update the QuantumNous new-api installation to version 0.9.0.5 or later, which introduces a robust, default-enabled SSRF protection module.

Proactive Monitoring: Review web server and application access logs for unusual outbound requests, particularly those targeting internal IP addresses or sensitive local services.

Compensating Controls: Implement strict egress filtering on the server hosting the application to prevent connections to unauthorized internal or external destinations.

Public Exploit Available: No (exploit_available: false)

Organizations utilizing QuantumNous new-api should prioritize upgrading to version 0.9.0.5 immediately to leverage the newly implemented SSRF protection features. Given the potential for internal network discovery and unauthorized interaction with backend services, failure to patch this vulnerability exposes the infrastructure to unnecessary risk from malicious or compromised user accounts.