An unauthenticated server-side request forgery vulnerability in Spring AI allows attackers to force the server to issue unauthorized requests to internal or external destinations.

The BedrockProxyChatModel component fails to properly validate user-supplied media URLs within multimodal messages. This allows an unauthenticated attacker to induce the server to perform arbitrary HTTP requests, potentially exposing internal network resources.

The exploitation of this SSRF vulnerability poses a significant risk to internal infrastructure security. An attacker can leverage the server to bypass network segmentation, interact with internal services that are not exposed to the public internet, or probe sensitive metadata endpoints. Given the CVSS score of 8.6, this flaw represents a high-severity risk that could lead to unauthorized information disclosure and lateral movement within the environment.

Immediate Action: Update the spring-ai-bedrock-converse dependency to version 1.0.5 or 1.1.4 immediately to incorporate the necessary URL validation logic.

Proactive Monitoring: Review application and network logs for suspicious outbound HTTP requests originating from the server, particularly those directed toward internal IP ranges or sensitive cloud metadata services.

Compensating Controls: Implement strict egress filtering on the application server to restrict outbound connections to only known, trusted endpoints, thereby limiting the impact of successful SSRF exploitation.

Public Exploit Available: No

This vulnerability presents a high risk to organizational security due to its unauthenticated nature and the potential for internal network reconnaissance. Security teams must prioritize updating the Spring AI library to the provided fixed versions. Failure to patch may allow attackers to utilize the application as a proxy for malicious activity within the internal network.