A Server-Side Request Forgery vulnerability in iFlytek astron-agent enables authenticated attackers to perform unauthorized requests, potentially leading to information disclosure or internal service abuse.

The flaw resides in the UrlCheckTool.checkUrl function within the debugToolV2 API endpoint. An authenticated attacker can manipulate the endPoint parameter to force the server to initiate arbitrary requests to internal or external resources.

Successful exploitation of this SSRF vulnerability allows an attacker to interact with internal network services that are otherwise inaccessible from the public internet. This can lead to the exposure of sensitive internal data, scanning of private network segments, or the exploitation of other vulnerable internal services, resulting in a breach of confidentiality and increased risk to the organizational network. The CVSS score of 6.3 reflects a moderate severity, primarily due to the requirement for authenticated access.

Immediate Action: Update iFlytek astron-agent to version reward-1575 or later to apply the vendor-provided security patch.

Proactive Monitoring: Monitor API access logs for unusual activity involving the debugToolV2 endpoint, specifically looking for requests containing unexpected URL schemes or internal IP addresses in the endPoint parameter.

Compensating Controls: Implement strict egress filtering on the application server to prevent it from initiating unauthorized connections to sensitive internal network segments.

Public Exploit Available: Unknown

Given the potential for internal network reconnaissance and service abuse, organizations utilizing the iFlytek astron-agent should prioritize upgrading to the fixed version. Administrators must verify that the update is applied across all instances of the agent to eliminate the SSRF vector and secure the debugToolV2 API.