The oobabooga text-generation-webui is vulnerable to unauthenticated Server-Side Request Forgery, enabling attackers to access sensitive cloud metadata and internal network services.

This is a Server-Side Request Forgery (CWE-918) flaw where the superbooga and superboogav2 RAG extensions fail to validate user-supplied URLs. An unauthenticated attacker can supply arbitrary URLs to be fetched by the server, leading to the exposure of cloud IAM credentials and internal network resources.

Successful exploitation poses a significant risk to organizational infrastructure by allowing attackers to move laterally from the web interface into the internal network. The ability to retrieve cloud metadata can lead to full compromise of cloud environments and theft of sensitive credentials. Given the CVSS score of 7.5, this high-severity vulnerability warrants immediate attention to prevent unauthorized access and potential data exfiltration.

Immediate Action: Update the oobabooga text-generation-webui software to version 4.3 or later to incorporate the necessary URL validation logic.

Proactive Monitoring: Review web server and application logs for unusual outbound requests to internal IP addresses or cloud metadata service endpoints (e.g., 169.254.169.254).

Compensating Controls: If immediate patching is not possible, restrict the server's network access to prevent it from reaching internal segments or sensitive cloud metadata endpoints.

Public Exploit Available: Unknown.

The risk posed by this SSRF vulnerability is severe due to its unauthenticated nature and the potential for cloud credential theft. Administrators must prioritize updating to version 4.3 immediately to close the attack vector. Failure to remediate this flaw exposes the underlying host and cloud infrastructure to unauthorized reconnaissance and lateral movement.