Executive brief
AstrBot, a chatbot management platform, contains a security flaw in its plugin update system. An authorized user can trick the server into making unauthorized network requests to internal or external systems. This could allow an attacker to scan internal networks, bypass firewalls, or access sensitive data from other services running in the same environment.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in AstrBot versions up to 4.25.2 within the `update_plugin` and `update_all_plugins` functions in `astrbot/dashboard/routes/plugin.py`. The application fails to validate the `download_url`, `download_urls`, and `proxy` parameters before passing them to the `httpx` client for file retrieval. An authenticated attacker can provide a malicious URL or proxy string, causing the server to perform outbound HTTP GET requests to arbitrary hosts, including internal loopback addresses or private network resources. The vulnerability is present because the application follows redirects and lacks an allowlist for schemes or IP ranges. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- AstrBotDevs AstrBot up to 4.25.2
Timeline
- 2026-06-09: disclosed: Initial discovery and PoC creation by researcher.
- 2026-07-17: advisory: Public disclosure of CVE-2026-16074.