parisneo lollms-webui Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in parisneo/lollms-webui version V13 (feather). The issue arises in the `POST /api/proxy` REST API, where attackers can exploit the vulnerability to misuse the victim server's credentials to access unauthorized web resources. This is achieved by specifying a JSON parameter with a URL targeting the desired resource. Notably, existing security measures do not mitigate this vulnerability.

Impact

Exploitation of this vulnerability allows for Server-Side Request Forgery, enabling attackers to access internal resources or external services on behalf of the server.