Description

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.6",
  "pubDate": "2026-08-10T11:17:31.017Z",
  "pubdate": "2026-08-10T11:17:31.017Z",
  "executiveSummary": "A server-side request forgery (SSRF) vulnerability exists in the duhow/xiaoai-patch project through commit fb07049. This security flaw resides in the /auth endpoint implemented within api/main.py, which processes a user-supplied url POST parameter intended to redirect users to a Home Assistant instance. Due to a complete lack of validation and sanitization on the destination URL, the application fails to restrict where HTTP requests are dispatched.\nThis vulnerability allows a remote attacker to force the affected Xiaomi smart speaker device to execute arbitrary HTTP GET or POST requests targeting both internal network resources and external endpoints. The primary impact includes facilitating unauthorized internal network reconnaissance, mapping internal services, and potentially interacting with restricted internal infrastructure that is otherwise shielded from direct external access.\nExploitation requires network reachability to the vulnerable endpoint exposed by the smart speaker. Because IoT devices are frequently deployed within trusted home or enterprise local area networks behind network address translation (NAT) boundaries, this flaw transforms the compromised smart speaker into a pivot point for localized attacks against adjacent network assets.",
  "technicalDetails": "The root cause of the vulnerability is the absence of input validation and destination URL restriction in the handling of the user-supplied url POST parameter. Within the vulnerable component, specifically the /auth endpoint located in api/main.py, the application accepts an arbitrary URI string supplied via HTTP POST requests and subsequently initiates an outbound HTTP connection or redirection to that exact destination without verifying its safety or scheme.\nThe attack flow begins when a remote attacker crafts a malicious HTTP POST request directed at the /auth endpoint of the target Xiaomi smart speaker running the vulnerable xiaoai-patch implementation. The attacker populates the url parameter with a targeted payload, which may reference an external URL for data exfiltration or an internal network address (such as localhost, private RFC 1918 IP ranges, or local service ports) to probe internal infrastructure.\nUpon receiving the request, the server-side logic in api/main.py processes the input and instructs the underlying HTTP client library to dispatch a request to the attacker-specified URL. Because the software does not implement an allowlist of permitted domains, IP address filtering, or checks against loopback and private address spaces, the smart speaker blindly performs the request on behalf of the attacker.\nThe payload behavior enables attackers to interact with internal microservices, administrative interfaces, and APIs that lack authentication or rely solely on network-level perimeter defenses. The post-exploitation impact includes information disclosure, localized network mapping, and unauthorized interaction with sensitive internal services accessible from the smart speaker's network position."
}