NextChat Server-Side Request Forgery / Cross-Site Scripting

NextChat Server-Side Request Forgery / Cross-Site Scripting

NextChat v2.12.3 suffers from a Server-Side Request Forgery (SSRF) and Cross-Site Scripting vulnerability due to a lack of validation of the GET parameter on the WebDav API endpoint.

The vulnerability exists because of the following code snippet : 

// Validate the endpoint to prevent potential SSRF attacks
  if (
    !mergedAllowedWebDavEndpoints.some(
      (allowedEndpoint) => endpoint?.startsWith(allowedEndpoint),
    )
  )

This check seems incomplete because it validates if the URL specified in the endpoint GET parameter starts with …

api attacks code cross-site endpoint forgery parameter prevent request scripting server server-side request forgery ssrf validation vulnerability webdav