Description

ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media URLs without validation or redirect filtering. Unauthenticated attackers can supply arbitrary image_url, audio_url, or video_url parameters to make the server issue requests to internal services and cloud metadata endpoints.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-04T15:17:46.360Z",
  "pubdate": "2026-09-04T15:17:46.360Z",
  "executiveSummary": "ms-swift version 4.5.2 is susceptible to a Server-Side Request Forgery (SSRF) vulnerability within its OpenAI-compatible deployment API.\nThe flaw allows unauthenticated remote attackers to force the application to perform unauthorized requests to arbitrary URIs.\nBy manipulating parameters such as image_url, audio_url, or video_url, an attacker can bypass security controls to interact with internal infrastructure.\nThe primary impact includes unauthorized access to internal services, discovery of private network topology, and potential exfiltration of sensitive information from cloud metadata services (e.g., AWS/GCP/Azure instance metadata endpoints).\nExploitation requires no authentication, making this a high-risk vulnerability that could lead to full-server compromise if the internal environment is not properly segmented.\nDefensive posture requires the immediate implementation of strict URL validation and network-level egress filtering.",
  "technicalDetails": "The vulnerability resides in the request processing logic of the ms-swift 4.5.2 deployment API responsible for handling multimodal inputs. The application fails to implement robust input validation or sanitization mechanisms for URI parameters, specifically image_url, audio_url, and video_url.\nThe root cause is a lack of server-side URL filtering and validation, allowing the application to process and fetch data from user-supplied endpoints without verifying if the destination is a trusted external resource or a restricted internal asset.\nWhen an attacker submits an API request containing a malicious URL, the backend process initiates a fetch operation. Because the application does not utilize an allowlist of permitted domains or validate that the provided URL does not resolve to local network addresses (e.g., 127.0.0.1, 169.254.169.254, or private RFC1918 ranges), it blindly acts as an SSRF proxy.\nThe attack flow follows these steps: 1) The attacker identifies the OpenAI-compatible API endpoint in ms-swift. 2) The attacker crafts a request containing an arbitrary parameter (e.g., image_url=http://169.254.169.254/latest/meta-data/iam/security-credentials/). 3) The ms-swift server receives this payload and proceeds to fetch the content from the provided URL. 4) The server performs the request using its own process identity, effectively bypassing any perimeter firewalls that would otherwise protect internal metadata services or internal microservices. 5) The server potentially returns the response body to the attacker or uses it to inform subsequent application logic.\nThis vulnerability is particularly severe in cloud-hosted environments where instance metadata services are reachable from the local network stack. An attacker can leverage this to retrieve sensitive IAM credentials, environment configuration, or interact with administrative interfaces of internal services that rely on 'trusted' network-level authentication.\nBecause the application does not enforce redirect filtering, an attacker could also provide a URL that returns an HTTP 3xx redirect to a sensitive internal resource, thereby bypassing simple regex-based input filters."
}