An unauthenticated server-side request forgery vulnerability in ModelScope AgentScope allows remote attackers to exfiltrate sensitive internal data and cloud metadata.

The application fails to validate URLs provided in multimodal content blocks, which are processed by the _get_bytes_from_web_url utility function in src/agentscope/_utils/_common.py. An unauthenticated attacker can supply a malicious URL to force the server to fetch internal resources and return the base64-encoded response content in the API output.

The vulnerability carries a CVSS score of 7.3, indicating a high severity risk. Successful exploitation allows an attacker to bypass network perimeters to access internal services, read sensitive configuration files, or retrieve cloud instance metadata, which may contain temporary security credentials. This could lead to a full compromise of the hosting infrastructure and significant data breach risks.

Immediate Action: Update the AgentScope installation to a version beyond 1.0.18 or apply the vendor-provided security patches once available.

Proactive Monitoring: Monitor application logs for unusual outbound requests originating from the server, specifically targeting private IP ranges such as 169.254.169.254 or internal network segments.

Compensating Controls: Implement strict egress filtering on the server to block requests to internal network ranges and restricted metadata services. Utilize a Web Application Firewall (WAF) to inspect and block requests containing suspicious URLs in multimodal message payloads.

Public Exploit Available: Yes, a detailed proof-of-concept exists in a published security advisory/gist (referenced in the GitHub research write-up).

Given the availability of a public proof-of-concept and the potential for severe data exfiltration, this vulnerability should be addressed immediately. Organizations using AgentScope for multimodal LLM processing must prioritize updating their software and enforcing strict network-level egress restrictions to mitigate the risk of SSRF-based attacks.