Description

Prowler is a cloud security platform. Prior to 5.33.1, an authenticated user with Lighthouse provider configuration access could supply an unvalidated base_url for the openai_compatible provider through POST /api/v1/lighthouse/providers and POST /api/v1/lighthouse/providers/{id}/connection, causing api/src/backend/tasks/jobs/lighthouse_providers.py to send outbound requests, including the API key in the Authorization header, to attacker-controlled or internal endpoints when client.models.list was called. This issue is fixed in version 5.33.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.6",
  "pubDate": "2026-08-12T15:18:31.087Z",
  "pubdate": "2026-08-12T15:18:31.087Z",
  "executiveSummary": "An information disclosure and Server-Side Request Forgery (SSRF) vulnerability exists in Prowler prior to version 5.33.1. The flaw resides in the Lighthouse provider configuration handling, where an authenticated user with specific access can supply an unvalidated base_url parameter.\nThis vulnerability allows an attacker to force the backend service to dispatch outbound HTTP requests to arbitrary attacker-controlled external endpoints or internal network resources. When the application invokes client.models.list using the supplied configuration, it inadvertently appends sensitive credentials, specifically the API key, within the Authorization header of the outgoing request.\nThe impact includes unauthorized exfiltration of sensitive API keys and potential unauthorized access to internal network services that are otherwise shielded from direct external exposure. Exploitation requires authenticated access to the Lighthouse provider configuration interface via POST /api/v1/lighthouse/providers or POST /api/v1/lighthouse/providers/{id}/connection.\nOrganizations utilizing affected versions of Prowler face significant risk if malicious actors compromise user accounts with Lighthouse provider configuration privileges, potentially leading to credential theft and internal reconnaissance.",
  "technicalDetails": "The vulnerability is caused by insufficient input validation and sanitization of the base_url parameter submitted during the configuration of the openai_compatible provider within the Lighthouse component of Prowler. Specifically, user-supplied input is processed by api/src/backend/tasks/jobs/lighthouse_providers.py without verifying whether the target URL conforms to expected external standards or restricts access to internal addresses.\nThe attack flow proceeds as follows: 1) An authenticated adversary with Lighthouse provider configuration access issues a malicious HTTP request to POST /api/v1/lighthouse/providers or POST /api/v1/lighthouse/providers/{id}/connection. 2) The request body includes a crafted base_url pointing to an internal service or an external attacker-controlled infrastructure. 3) The backend task processes the configuration and executes client.models.list utilizing the provided openai_compatible provider parameters. 4) During this execution, the application initiates an outbound HTTP connection to the malicious or internal base_url specified by the attacker. 5) Crucially, the outgoing request includes sensitive authentication material, specifically the configured API key, embedded directly within the Authorization header. 6) The receiving endpoint captures the sensitive Authorization header, facilitating credential theft, or the internal service processes the request, resulting in Server-Side Request Forgery.\nThe vulnerable component is identified as api/src/backend/tasks/jobs/lighthouse_providers.py within Prowler versions prior to 5.33.1. Prerequisites for successful exploitation include authenticated access to the API endpoints and possession of privileges associated with Lighthouse provider configuration. Network exposure is restricted to environments where the Prowler backend can initiate outbound or internal network requests based on task execution."
}