FastGPT Intranet SSRF Vulnerability Allowing Access to Private Data
Vulnerability
A server-side request forgery (SSRF) vulnerability has been identified in FastGPT versions prior to 4.9.0. The issue arises because the web crawling plugin does not validate intranet IP addresses. This lack of verification allows an attacker to send requests through the intranet, potentially accessing private data.
Impact
Exploitation of this vulnerability could lead to unauthorized access to sensitive intranet data.
Remediation
Users can upgrade to FastGPT version 4.9.0 or later to address this vulnerability.
Added: Jun 9, 2025, 7:46 PM
Updated: Jun 9, 2025, 7:46 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
7.4remediation
7.7relevance
0.0threat
0.0urgency
2.9incentive
5.8Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.