A Server-Side Request Forgery vulnerability in linshenkx prompt-optimizer versions 1.3.0 through 1.4.2 allows unauthenticated attackers to probe internal network resources.

This is a Server-Side Request Forgery (SSRF) vulnerability residing in the /api/proxy/ endpoint. The vulnerability is exploitable by an unauthenticated attacker who can send crafted requests to the application to interact with internal infrastructure.

The ability for an unauthenticated actor to perform SSRF poses a significant risk to internal network segmentation. An attacker can leverage this flaw to bypass firewalls, access internal services that are not exposed to the public internet, and potentially exfiltrate sensitive configuration data. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized lateral movement within the environment.

Immediate Action: Review the vendor GitHub repository for updates or configuration changes that address the /api/proxy/ SSRF flaw. If an official patch is not available, consider disabling the vulnerable proxy component entirely.

Proactive Monitoring: Monitor server access logs for unusual patterns of requests directed at the /api/proxy/ endpoint. Look specifically for requests containing internal IP addresses or non-standard port numbers in the parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize requests targeting the /api/proxy/ path. Restrict outbound network access from the server hosting the application to prevent it from reaching internal resources.

Public Exploit Available: Unknown.

Given the confirmed existence of proof-of-concept material and the high-severity nature of SSRF vulnerabilities, administrators should prioritize securing the /api/proxy/ endpoint. If an update is not yet published by the maintainer, the most effective mitigation is to restrict access to the vulnerable component or disable it until a verified fix is implemented.