CyberRota Analysis
AI-GeneratedThe vulnerability affects the /v1/web/fetch endpoint in 9Router versions prior to 0.4.72, allowing authenticated or locally-connected users to exploit a server-side request forgery (SSRF) flaw. This weakness permits the fetching of arbitrary internal URLs, potentially exposing sensitive data such as cloud metadata credentials and enabling unauthorized access to internal services. Organizations using 9Router should prioritize addressing this vulnerability to mitigate risks associated with unauthorized data exposure and internal network access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
9Router before 0.4.72 contains a server-side request forgery (SSRF) vulnerability in the /v1/web/fetch endpoint. The endpoint accepts a user-controlled url parameter and passes it to a configured external scraping provider (Firecrawl, Jina Reader, Tavily, or Exa) to fetch content. The URL is only validated as syntactically valid via new URL() with no blocklist for private IP ranges, cloud metadata endpoints (e.g., 169.254.169.254), link-local addresses, or internal hostnames. An authenticated or locally-connected user can cause the server to fetch arbitrary internal URLs and have the response content returned, enabling read-access SSRF that can expose cloud metadata credentials, reach internal services, and bypass authentication on localhost endpoints.