CyberRota Analysis
AI-GeneratedNextChat versions 2.15.8 to 2.16.1 are vulnerable due to improper URL validation in the proxy endpoint, which permits attackers to exploit the x-base-url header. This flaw enables unauthorized access to the server's OpenAI API key, potentially compromising sensitive data and API interactions. Organizations using affected NextChat versions should prioritize patching this vulnerability to safeguard their API credentials and prevent potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint that allows attackers to obtain the server's OpenAI API key. The x-base-url header is validated using substring matching instead of hostname parsing, allowing any URL containing 'api.openai.com' to pass validation and receive the server's credentials in the Authorization header.