CVE-2025-66201

Executive Summary

CVE-2025-66201 is a Server-Side Request Forgery (SSRF) vulnerability in LibreChat, an open-source ChatGPT clone. The flaw resides in the "Actions" feature, which allows authenticated users to upload custom OpenAPI specifications. By crafting a malicious OpenAPI spec, an attacker can trick the LibreChat server into making HTTP requests to internal or cloud metadata services that are otherwise inaccessible from the internet. This can lead to information disclosure, such as cloud provider credentials, and potentially enable server impersonation. The vulnerability is patched in version 0.8.1-rc2. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

LibreChat is a Node.js application. The vulnerability is introduced through the processing of user-supplied OpenAPI specs, which are parsed and executed by the server. This does not directly involve a compromised dependency, but the risk of supply chain attacks is present if an attacker can inject malicious specs through a compromised third-party integration or plugin. The patch likely involves stricter validation of OpenAPI spec URLs and preventing requests to private IP ranges.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
• Base Score: 7.7 (High)
• Attack Vector: Network (AV:N) – The attack is carried out over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker must be an authenticated user with access to the "Actions" feature.
• User Interaction: None (UI:N) – No user interaction is required.
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope (internal network).
• Confidentiality: High (C:H) – Sensitive internal data (e.g., cloud metadata) can be disclosed.
• Integrity: None (I:N) – No data modification is possible.
• Availability: None (A:N) – No denial of service.

Threat Level: High. While authentication is required, the potential for accessing cloud metadata and internal services makes this a critical risk for cloud-hosted deployments.

Deep Dive & Mechanics

The vulnerability is triggered through LibreChat's "Actions" feature, which allows users to define custom API endpoints for the LLM to call. These endpoints are specified using OpenAPI (Swagger) specs. The server parses the spec and makes HTTP requests to the defined URLs.

The flaw is that the server does not properly validate the URLs in the OpenAPI spec. An attacker can craft a spec that points to internal IP addresses (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata) or other internal services. When the LLM uses the action, the server makes a request to that URL, effectively performing an SSRF attack.

Attack Flow:

1. Attacker logs into LibreChat.
2. Attacker creates a new "Action" with a malicious OpenAPI spec.
3. The spec contains a URL pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/).
4. The LLM is triggered to use the action (e.g., via a prompt).
5. The LibreChat server makes an HTTP request to the internal URL.
6. The response (e.g., cloud metadata) is returned to the attacker.

Vulnerable vs. Patched Code

No specific code diff is available. However, the patch likely involves:

• Vulnerable: The server accepts any URL in the OpenAPI spec without validation.
• Patched: The server validates that the URL is not a private IP (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16) and does not resolve to a loopback or link-local address.

Hypothetical vulnerable code (Node.js):

// Vulnerable: No URL validation
const url = openApiSpec.servers[0].url;
const response = await fetch(url);

Hypothetical patched code:

// Patched: Validate URL
const url = openApiSpec.servers[0].url;
const parsedUrl = new URL(url);
if (isPrivateIP(parsedUrl.hostname)) {
    throw new Error('URL is not allowed');
}
const response = await fetch(url);

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a LibreChat instance (authenticated user).
• The "Actions" feature enabled.

Steps:

1. Log in to LibreChat.
2. Navigate to the "Actions" section.
3. Create a new action with the following OpenAPI spec:

openapi: 3.0.0
info:
  title: Malicious Action
  version: 1.0.0
servers:
  - url: http://169.254.169.254/latest/meta-data/
paths:
  /:
    get:
      summary: Get metadata
      responses:
        '200':
          description: OK

4. Save the action.
5. In a conversation, prompt the LLM to use the action (e.g., "Use the Malicious Action to get metadata").
6. The server will make a request to the AWS metadata endpoint and return the data.

Alternative payloads:

• http://127.0.0.1:8080/ (internal service)
• http://10.0.0.1/ (private network)
• http://[::1]:22/ (IPv6 loopback)

Blue Team (Defender)

Detection:

• Monitor outbound HTTP requests from the LibreChat server to private IP ranges.
• Look for requests to 169.254.169.254 (cloud metadata) or other internal addresses.
• Audit logs for creation of new "Actions" with suspicious URLs.

Hunting:

• Search for OpenAPI specs containing private IPs or hostnames.
• Check for unusual outbound connections from the LibreChat server.

Prevention:

• Apply the patch (upgrade to 0.8.1-rc2 or later).
• Implement network segmentation to restrict the server's outbound access.
• Use a web application firewall (WAF) to block requests to private IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Outbound HTTP requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
  • Outbound HTTP requests to 127.0.0.1 or localhost
• File IOCs:
  • OpenAPI spec files containing private IP addresses
• Log IOCs:
  • Log entries showing fetch or request to private IPs
  • Log entries showing creation of actions with suspicious URLs

Detection Engineering

YARA Rule

rule CVE_2025_66201_SSRF_LibreChat {
    meta:
        description = "Detects malicious OpenAPI specs targeting private IPs for SSRF"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66201"
    strings:
        $private_ip1 = /"url":\s*"http:\/\/10\.\d{1,3}\.\d{1,3}\.\d{1,3}/
        $private_ip2 = /"url":\s*"http:\/\/172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}/
        $private_ip3 = /"url":\s*"http:\/\/192\.168\.\d{1,3}\.\d{1,3}/
        $private_ip4 = /"url":\s*"http:\/\/127\.\d{1,3}\.\d{1,3}\.\d{1,3}/
        $private_ip5 = /"url":\s*"http:\/\/169\.254\.\d{1,3}\.\d{1,3}/
        $private_ip6 = /"url":\s*"http:\/\/\[::1\]/
    condition:
        any of ($private_ip*)
}

Sigma Rule

title: CVE-2025-66201 SSRF via LibreChat Actions
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects outbound HTTP requests from LibreChat server to private IP ranges
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66201
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        DestinationIp:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '127.0.0.0/8'
            - '169.254.0.0/16'
            - '::1'
        Image: '*librechat*'
    condition: selection
falsepositives:
    - Legitimate internal service calls (if configured)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66201 SSRF Attempt to Private IP"; flow:to_server; content:"GET"; http_method; content:"/latest/meta-data/"; http_uri; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66201 SSRF Attempt to Private IP Range"; flow:to_server; content:"GET"; http_method; ip_proto:tcp; dst_ip:10.0.0.0/8; sid:1000002; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66201 SSRF Attempt to Private IP Range"; flow:to_server; content:"GET"; http_method; ip_proto:tcp; dst_ip:172.16.0.0/12; sid:1000003; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66201 SSRF Attempt to Private IP Range"; flow:to_server; content:"GET"; http_method; ip_proto:tcp; dst_ip:192.168.0.0/16; sid:1000004; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66201 SSRF Attempt to Loopback"; flow:to_server; content:"GET"; http_method; ip_proto:tcp; dst_ip:127.0.0.0/8; sid:1000005; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade LibreChat to version 0.8.1-rc2 or later.
• If upgrade is not possible, disable the "Actions" feature temporarily.

Network-Level:

• Restrict outbound traffic from the LibreChat server using a firewall or egress rules.
• Block access to cloud metadata endpoints (e.g., 169.254.169.254).
• Use a proxy that validates destination IPs.

Application-Level:

• Implement strict URL validation in the OpenAPI spec parser.
• Deny requests to private IP ranges, loopback, and link-local addresses.
• Use a blocklist/allowlist approach for allowed domains.

Monitoring:

• Enable logging for all outbound HTTP requests.
• Set up alerts for requests to private IPs.
• Regularly audit "Actions" configurations.

Valters IT
DevSecOps & Cyber Threat Intelligence