NVIDIA NemoClaw Server-Side Request Forgery Vulnerability in SSRF Protection Component

A server-side request forgery (SSRF) vulnerability has been identified in NVIDIA NemoClaw, specifically within the validateEndpointUrl() component responsible for SSRF protection. This vulnerability allows an attacker to craft an endpoint URL that references the 0.0.0.0/8 address range, which can be delivered through a blueprint configuration file or a command-line interface (CLI) flag. Exploiting this vulnerability successfully may result in unauthorized information disclosure.

Impact

Exploitation of this vulnerability could lead to server-side request forgery, allowing attackers to manipulate server requests and potentially access or disclose sensitive information.

Remediation

Users are advised to update to version 0.0.13 or later. The updated version can be downloaded from the NVIDIA NemoClaw GitHub repository.