An unauthenticated SSRF vulnerability in ChatGPTNextWeb NextChat versions 2.16.0 and 2.16.1 allows remote attackers to force the application to perform unauthorized requests, posing a significant risk to internal network security.

The flaw resides in the proxyHandler function within the route.ts file, which fails to validate the user-controlled x-base-url HTTP header. This allows unauthenticated remote attackers to manipulate the destination URL and force the server to fetch arbitrary resources.

Successful exploitation enables an attacker to bypass perimeter security to interact with internal services that are otherwise inaccessible from the public internet. This can lead to the exposure of sensitive internal data, cloud metadata, or internal service credentials, ultimately resulting in a compromise of the application server or the broader internal environment. With a CVSS score of 7.3, this vulnerability represents a high-severity risk to operational security and data confidentiality.

Immediate Action: Upgrade to a version of ChatGPTNextWeb NextChat that contains the fix for this SSRF vulnerability, as the current versions 2.16.0 and 2.16.1 are confirmed vulnerable.

Proactive Monitoring: Review web server and application access logs for suspicious requests directed at the /api/ path, particularly those containing unusual x-base-url headers or attempts to resolve internal IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) or ingress filtering to inspect and block incoming HTTP requests that contain suspicious or unauthorized x-base-url headers.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's published technical write-up on GitHub Gist.

The presence of a public proof-of-concept significantly elevates the risk of exploitation for this vulnerability. Security teams must prioritize identifying and patching all instances of ChatGPTNextWeb NextChat within their environment. If immediate patching is not feasible, restrict network access to the application to trusted sources and implement strict WAF rules to validate the legitimacy of incoming HTTP headers.