CVE-2023-49785

What it actually does

The vulnerability exposes NextChat/ChatGPT-Next-Web versions 2.11.2 and earlier to unauthenticated server-side request forgery and cross-site scripting. An attacker can cause the application server to issue HTTP requests to arbitrary destinations, including internal-only services, cloud metadata endpoints, loopback interfaces, and administrative APIs that are not normally reachable from the Internet. Because the SSRF supports methods beyond GET, including POST and PUT, it can be used not only to read internal resources but also to modify state in reachable backend services. The XSS component can allow attacker-controlled script execution in a victim browser where vulnerable content is rendered, potentially enabling session theft, user impersonation, or malicious actions in the application context.

Why it matters to the business

Publicly exposed vulnerable deployments can become an entry point into otherwise private infrastructure. Attackers may use them to discover internal services, access cloud instance metadata, interact with administrative endpoints, pivot traffic through the organization as an open proxy, or conduct attacks against third parties while hiding behind the affected server’s IP address. With a CVSS score of 9.1, high EPSS probability, weaponized exploit maturity, and publication dating back more than two years, Internet-facing instances should be treated as high-risk even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an Internet-exposed NextChat/ChatGPT-Next-Web instance running version 2.11.2 or earlier. They then send crafted requests to the vulnerable server-side request functionality so the application fetches attacker-specified URLs. Initial probes commonly target loopback addresses, RFC1918 ranges, service discovery endpoints, and cloud metadata services to determine what the server can reach. If internal services respond, the attacker can read responses through the vulnerable application and may issue state-changing POST, PUT, or similar requests to internal APIs. In parallel or afterward, the attacker may inject JavaScript payloads where the application reflects or renders untrusted content, causing execution in users’ browsers. The same SSRF primitive can also be abused as an open proxy to relay malicious traffic toward external targets, making the organization’s server appear to be the source.

How to fix it

Upgrade to a version that explicitly fixes CVE-2023-49785 if a maintained fixed release is available from the NextChat/ChatGPT-Next-Web project or downstream distributor. Where no fixed version is available, do not expose affected versions to the public Internet. Place the application behind authentication, VPN, or a trusted access proxy; isolate it in a network segment with no access to internal services; block egress from the application to private IP ranges, loopback, link-local addresses, cloud metadata IPs, and unnecessary Internet destinations; and restrict allowed HTTP methods and destinations at a reverse proxy or egress firewall. Disable or remove any proxy, fetch, import, preview, or CORS-forwarding functionality that accepts user-supplied URLs unless destination allowlisting is enforced. Apply standard XSS defenses as well, including output encoding, content security policy, and sanitization of user-controlled content.

How to confirm the fix worked

Confirm the deployed version is newer than 2.11.2 or that a vendor-confirmed fix has been applied. If no fixed version is deployed, verify compensating controls by attempting controlled requests from the application to loopback, RFC1918 addresses, link-local metadata addresses such as 169.254.169.254, and known internal-only test endpoints; these requests should be blocked and logged. Validate that public access requires authentication or network-level trust, that the application cannot reach internal administrative services, and that outbound firewall rules deny private and metadata ranges. For XSS validation, use safe test payloads to confirm that user-supplied content is encoded or sanitized rather than executed in the browser.

Typical attack path

1. Scan the Internet or known assets for exposed NextChat/ChatGPT-Next-Web deployments.
2. Fingerprint the application version or behavior to identify versions 2.11.2 or earlier.
3. Send crafted requests that cause the server to fetch attacker-controlled or internal URLs.
4. Probe loopback, private network ranges, container metadata endpoints, cloud metadata endpoints, and internal administrative services.
5. Read returned internal responses through the vulnerable application.
6. Use non-GET HTTP methods such as POST or PUT to alter reachable internal services where possible.
7. Inject or deliver XSS payloads if a vulnerable rendering path is reachable by users.
8. Use the compromised application as a proxy to access internal systems or to relay traffic toward third-party Internet targets.

How to detect it

Review web server, reverse proxy, application, container, and outbound network logs for evidence that the application was instructed to fetch internal or unusual destinations. Focus on requests containing full URLs, URL-encoded URLs, private IP addresses, loopback addresses, link-local metadata addresses, internal hostnames, and non-GET methods such as POST, PUT, PATCH, or DELETE. Correlate inbound suspicious requests with outbound connections from the application process or container to internal services, cloud metadata endpoints, or unexpected Internet targets. Investigate repeated requests to 127.0.0.1, localhost, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, ::1, fc00::/7, and 169.254.169.254. For XSS, inspect access logs, application logs, stored user content, and browser security telemetry for script tags, event-handler attributes, javascript: URLs, encoded payloads, and CSP violation reports. If cloud metadata access is observed, review cloud audit logs for temporary credential retrieval or subsequent API calls from unusual IP addresses, user agents, or geographies. Also look for evidence that the server was used as an open proxy, such as high-volume outbound requests to unrelated external targets shortly after suspicious inbound requests.

• /api/cors/
• 169.254.169.254/latest/meta-data
• 169.254.169.254/metadata/instance
• http://169.254.169.254
• http://127.0.0.1
• http://localhost
• http://0.0.0.0
• http://[::1]
• http://10.
• http://172.16.
• http://172.17.
• http://172.18.
• http://172.19.
• http://172.20.
• http://172.21.
• http://172.22.
• http://172.23.
• http://172.24.
• http://172.25.
• http://172.26.
• http://172.27.
• http://172.28.
• http://172.29.
• http://172.30.
• http://172.31.
• http://192.168.
• %31%32%37%2e%30%2e%30%2e%31
• %31%36%39%2e%32%35%34%2e%31%36%39%2e%32%35%34
• %2f/latest%2fmeta-data
• <script
• %3Cscript
• javascript:
• onerror=
• onload=

What your security team should do

• Immediately inventory Internet-facing NextChat/ChatGPT-Next-Web deployments and identify any running version 2.11.2 or earlier.
• Prioritize remediation for any public instance because exploit maturity is weaponized and EPSS is high.
• If a fixed release is unavailable or cannot be applied quickly, remove public exposure and require VPN, SSO-aware access proxy, or equivalent authenticated access.
• Implement strict egress filtering from the application host or container, especially blocking loopback, RFC1918, link-local, multicast, and cloud metadata address ranges.
• Review logs for historical SSRF probing and open-proxy abuse, particularly requests containing internal IP literals, metadata service paths, unusual HTTP methods, or absolute external URLs.
• Check cloud audit logs and instance metadata credential usage for evidence that temporary credentials were accessed or abused from the application environment.
• Harden reverse proxies and WAF rules to block user-supplied URL fetches to private destinations and to reject obvious XSS payloads.
• Rotate secrets that may have been reachable from the application environment if exploitation is suspected, including API keys, cloud credentials, and service tokens.