CyberRota Analysis
AI-GeneratedThe Portkey AI Gateway versions up to 1.15.2 are vulnerable to a server-side request forgery (SSRF) due to the absence of request validation on the /v1/proxy/* route. This flaw allows attackers to manipulate the x-portkey-custom-host header, enabling them to forward requests with sensitive Authorization headers to internal services, potentially leading to the exfiltration of provider API keys. Organizations using this gateway should prioritize remediation to mitigate the risk of unauthorized access to internal resources.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys.