Description

TypeBot is a chatbot builder tool. Prior to version 3.16.0, the OpenAI "Create Transcription" action handler fetches a user-supplied audio URL using `fetch()` without applying the SSRF protection that exists elsewhere in the codebase. An attacker can direct the server to make HTTP requests to arbitrary internal addresses and localhost. The fetched content is passed to the OpenAI Whisper API and the transcription result is returned to the attacker. Version 3.16.0 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-11T21:17:36.677Z",
  "pubdate": "2026-08-11T21:17:36.677Z",
  "executiveSummary": "TypeBot prior to version 3.16.0 contains a Server-Side Request Forgery (SSRF) vulnerability within the OpenAI \"Create Transcription\" action handler. The vulnerability exists due to the application fetching user-supplied audio URLs utilizing the native fetch() function without enforcing the established Server-Side Request Forgery protection mechanisms present in other areas of the codebase. An unauthenticated attacker capable of interacting with the affected chatbot builder workflows can leverage this flaw to coerce the hosting server into issuing arbitrary HTTP requests toward internal network resources, private IP spaces, and localhost infrastructure. By supplying a crafted internal URL, the attacker forces the server to retrieve remote content and transmit it directly to the OpenAI Whisper API, subsequently returning the transcription results back to the external user interface. This grants malicious actors unauthorized visibility into internal network topologies and services that are otherwise segregated from external exposure. The risk implications encompass potential information disclosure of internal microservices, cloud metadata services, and locally bound administrative interfaces. Mitigation requires upgrading the affected TypeBot installation to version 3.16.0 or later, where the standard Server-Side Request Forgery protection logic is correctly integrated into the OpenAI Create Transcription action handler.",
  "technicalDetails": "The vulnerability resides in the OpenAI \"Create Transcription\" action handler component of the TypeBot application prior to version 3.16.0. The root cause of the issue stems from an inconsistency in security control implementation, specifically the failure to apply centralized Server-Side Request Forgery (SSRF) sanitization and validation wrappers around network retrieval functions. While the broader TypeBot codebase enforces strict Uniform Resource Locator (URL) filtering and domain whitelisting or blacklisting via dedicated Server-Side Request Forgery protection utilities, the specific code path responsible for ingesting user-supplied audio URLs for transcription bypasses these defensive checks entirely.\nDuring standard execution, the vulnerable handler accepts an arbitrary URL parameter provided via user input. It passes this string directly into an unvalidated fetch() system call without performing protocol validation, scheme restriction, or IP address range evaluation. This allows the application server to resolve and query arbitrary network destinations, including loopback addresses (127.0.0.1, ::1), link-local spaces, and RFC 1918 internal network blocks.\nThe step-by-step attack flow proceeds as follows: First, the attacker formulates a malicious workflow payload containing a targeted internal URL within the audio source parameter of the OpenAI Create Transcription action. Second, the TypeBot server processes the action and initiates an outbound HTTP GET request using the vulnerable fetch() implementation toward the specified internal address. Third, the internal resource responds to the server-side request, returning internal data, markup, or binary content to the TypeBot backend. Fourth, the application captures this retrieved content and forwards it as an audio payload to the external OpenAI Whisper Application Programming Interface (API) for processing. Finally, the OpenAI API returns the textual transcription of the retrieved internal data back to the TypeBot interface, exposing the contents of the internal resource to the attacker.\nThe vulnerable component is explicitly the OpenAI \"Create Transcription\" action handler module operating in TypeBot versions prior to 3.16.0. Exploitation of this flaw can be executed remotely over the network without requiring prior authentication or elevated privileges, provided the attacker can invoke the affected action handler. Post-exploitation impact includes unauthorized data exfiltration from internal endpoints, potential interaction with internal application programming interfaces, and reconnaissance of internal cloud metadata endpoints."
}