SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation

Advisory Details

Title: SSRF Vulnerability in Laf Workflow Node via Missing Internal Address Validation

Description:

Summary

An unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows attackers (or authenticated users with App editing privileges) to send arbitrary HTTP requests to internal/private network addresses. The fetchData function in the lafModule workflow node uses axios to fetch user-controlled URLs without validating them against the application's internal network blocklist guard (isInternalAddress), bypassing SSRF protections.

Details

The root cause exists in packages/service/core/workflow/dispatch/tools/runLaf.ts. The lafModule is designed to be an internal workflow node that communicates with Laf instances. However, the exact endpoint that it queries (system_httpReqUrl) can be controlled by a user constructing a custom workflow API request or modifying the workflow graph.

When the workflow accesses the lafModule, it simply calls fetchData:

// packages/service/core/workflow/dispatch/tools/runLaf.ts
async function fetchData({
  method,
  url,
  body
}: {
  method: string;
  url: string;
  body: Record<string, any>;
}): Promise<Record<string, any>> {
  const { data: response } = await axios({
    method,
    baseURL: `http://${SERVICE_LOCAL_HOST}`,
    url,
    headers: {
      'Content-Type': 'application/json'
    },
    data: body
  });
...

Although baseURL is specified, axios natively ignores the baseURL if the provided url parameter (derived from system_httpReqUrl) is an absolute path (e.g., http://192.168.1.1/). This bypasses the localized scope intended by the developers. Furthermore, unlike the standard HTTP extension nodes (http468.ts), fetchData performs no validation using isInternalAddress to block loopback interfaces, AWS IMDS metadata endpoints (169.254.169.254), or Docker internal overlay bridge IP boundaries.

PoC

1. Log into FastGPT as a standard user or an app owner.
2. Intercept an application creation or workflow modification API request to include a lafModule node. Alternatively, construct a payload targeting the /v1/chat/completions or /api/core/chat/chatTest interface where node injection is permitted.
3. Configure the lafModule node with the following input arguments:
   • system_httpReqUrl: http://fastgpt-minio:9000/minio/health/live (or any internal server URL like http://169.254.169.254/latest/meta-data/)
   • system_addInputParam: {}
4. Trigger the workflow node computation.
5. The FastGPT backend server will make a direct POST request to the provided target address, returning the internal network response in the nodeResponse / httpRawResponse output edge.

Log of Evidence

[*] Target Internal URL: http://fastgpt-minio:9000/minio/health/live
[*] Triggering SSRF via /core/chat/chatTest ...
[SUCCESS] Exploit completed! SSRF Data retrieved:
event: flowResponses
data: [{"moduleAvatar":"core/workflow/template/lafDispatch","moduleName":"Laf request","moduleType":"lafModule", "nodeId":"laf-node", "position":{"x":0,"y":0},"httpRawResponse":"OK"}]
[*] The internal request was successfully executed and the response returned.

Impact

This vulnerability allows Server-Side Request Forgery.

• Confidentiality: Attackers can probe internal services (e.g., databases, Redis, Minio, internal microservices) and read their responses.
• Integrity/Availability: If the internal services accept unauthenticated POST requests, attackers can modify internal system states, send administrative commands, or exhaust internal resources.

Affected products

• Ecosystem: npm
• Package name: fastgpt
• Affected versions: All versions supporting the Laf workflow module plugin.

Severity

• Severity: High
• Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Weaknesses

• CWE-918: Server-Side Request Forgery (SSRF)

Occurrences