CVE-2025-69222

Executive Summary

CVE-2025-69222 is a critical Server-Side Request Forgery (SSRF) vulnerability in LibreChat version 0.8.1-rc2. The flaw resides in the Actions feature, which allows users to configure agents with OpenAPI specifications. By default, no restrictions are placed on accessible services, enabling an attacker to force the server to make requests to internal components, such as the RAG API included in the default Docker Compose setup. This can lead to unauthorized access to internal systems, data exfiltration, and potential lateral movement within the network. The vulnerability has a CVSS score of 9.1, indicating critical severity. No public exploit code or Nuclei template is available at this time, but the attack vector is straightforward due to the lack of restrictions.

Supply Chain & Package Security

LibreChat is a Node.js application. The vulnerability is not in a specific package but in the application's configuration and feature implementation. However, the default Docker Compose setup includes the RAG API, which is an internal component that becomes exposed via the SSRF. Users should review their Docker Compose configurations and ensure that internal services are not accessible from the LibreChat container.

CVSS Breakdown & Threat Level

• CVSS Score: 9.1 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - The attacker does not need to interact with a user.
• Scope: Unchanged (S:U) - The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) - Sensitive internal data can be accessed.
• Integrity Impact: High (I:H) - Internal services can be modified.
• Availability Impact: High (A:H) - Internal services can be disrupted.

Deep Dive & Mechanics

The vulnerability is rooted in the Actions feature of LibreChat. This feature allows users to define agents that can interact with external services via OpenAPI specifications. The agent can be configured to use various HTTP methods, parameters, and authentication methods, including custom headers. The critical flaw is that there are no default restrictions on the URLs that the agent can access. This means an attacker can craft an OpenAPI specification that points to internal services, such as the RAG API (typically running on http://rag-api:5000 in the default Docker Compose setup).

When the agent executes an action, the LibreChat server makes an HTTP request to the specified URL. If the URL points to an internal service, the request originates from the server itself, bypassing network firewalls and access controls. This allows the attacker to interact with internal services as if they were on the server's network.

The RAG API is particularly dangerous because it may contain sensitive data or provide access to other internal systems. The attacker can use the SSRF to read, modify, or delete data from the RAG API, or potentially pivot to other internal services.

Vulnerable vs. Patched Code

The vulnerable code is in the configuration of the Actions feature. In version 0.8.1-rc2, there are no restrictions on the URLs that can be used in OpenAPI specifications. The patched version (0.8.1-rc2, as per vendor) likely introduces a blocklist or allowlist for internal IP ranges (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or requires explicit configuration to allow internal access.

Vulnerable Code (Conceptual):

// No URL validation
const url = req.body.url;
const response = await fetch(url);

Patched Code (Conceptual):

const url = req.body.url;
if (isInternalIP(url)) {
  throw new Error('Access to internal services is not allowed');
}
const response = await fetch(url);

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy LibreChat 0.8.1-rc2 using the default Docker Compose setup.
2. Ensure the RAG API is running on http://rag-api:5000.
3. Create a user account and log in.

Exploitation Steps:

1. Navigate to the Actions configuration page.
2. Create a new action with an OpenAPI specification that targets the internal RAG API. For example:

   openapi: 3.0.0
   info:
     title: Internal RAG API
     version: 1.0.0
   paths:
     /data:
       get:
         summary: Get data
         responses:
           '200':
             description: Success
   servers:
     - url: http://rag-api:5000
   

3. Execute the action. The server will make a request to http://rag-api:5000/data and return the response to the attacker.
4. The attacker can now read sensitive data from the RAG API.

Advanced Exploitation:

• Use the SSRF to scan internal ports and services.
• Exploit other internal services (e.g., Redis, databases) if they are accessible.
• Use the SSRF to perform blind SSRF attacks to exfiltrate data via out-of-band channels.

Blue Team

Detection:

• Monitor outbound HTTP requests from the LibreChat server to internal IP ranges.
• Look for requests to rag-api, localhost, 127.0.0.1, or other internal addresses.
• Analyze OpenAPI specifications for suspicious URLs.

Prevention:

• Update to the patched version (0.8.1-rc2) immediately.
• Implement network segmentation to isolate the LibreChat server from internal services.
• Use a web application firewall (WAF) to block requests to internal IP ranges.
• Restrict the Actions feature to only allow predefined, safe URLs.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Outbound HTTP requests from the LibreChat server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1).
  • Requests to rag-api or other internal service names.
• Logs:
  • LibreChat server logs showing requests to internal URLs.
  • RAG API logs showing requests from the LibreChat server.
• File System:
  • OpenAPI specifications containing internal URLs.
• Processes:
  • Unusual outbound connections from the LibreChat Node.js process.

Detection Engineering

YARA Rule

rule CVE_2025_69222_SSRF_LibreChat {
    meta:
        description = "Detects OpenAPI specifications targeting internal services in LibreChat"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69222"
    strings:
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $rag_api = "rag-api"
        $localhost = "localhost"
    condition:
        any of ($internal_ip) or $rag_api or $localhost
}

Sigma Rule

title: CVE-2025-69222 SSRF in LibreChat
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts via LibreChat Actions feature
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: librechat
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/actions/*'
        cs-uri-query:
            - '*rag-api*'
            - '*localhost*'
            - '*127.0.0.1*'
            - '*10.*'
            - '*172.16.*'
            - '*172.17.*'
            - '*172.18.*'
            - '*172.19.*'
            - '*172.20.*'
            - '*172.21.*'
            - '*172.22.*'
            - '*172.23.*'
            - '*172.24.*'
            - '*172.25.*'
            - '*172.26.*'
            - '*172.27.*'
            - '*172.28.*'
            - '*172.29.*'
            - '*172.30.*'
            - '*172.31.*'
            - '*192.168.*'
    condition: selection
falsepositives:
    - Legitimate use of internal services if explicitly configured
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-69222 SSRF in LibreChat"; flow:to_server,established; content:"GET"; http_method; content:"/api/actions/"; http_uri; pcre:"/(rag-api|localhost|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update LibreChat to version 0.8.1-rc2 or later. The vendor states this version fixes the issue.
2. Network Segmentation: Ensure the LibreChat server cannot access internal services unless explicitly required. Use firewall rules to block outbound traffic to private IP ranges.
3. Configuration Hardening: If the Actions feature is not needed, disable it. If required, implement a strict allowlist of allowed URLs.
4. Monitoring: Enable logging and monitoring for SSRF attempts using the provided detection rules.
5. WAF Rules: Deploy WAF rules to block requests containing internal IP addresses or hostnames.
6. Regular Audits: Periodically review OpenAPI specifications and agent configurations for suspicious URLs.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert