Executive brief
9Router is a dashboard application that manages OpenID Connect (OIDC) authentication configurations. An attacker can send HTTP requests to an unauthenticated endpoint without logging in, causing the application to make outbound connections to arbitrary internal or external servers specified by the attacker. This allows an attacker to discover internal network topology, scan internal services for open ports, or manipulate how the application processes authentication configuration data—all without valid credentials.
Technical details
The vulnerability exists in `src/app/api/auth/oidc/test/route.js`, where the endpoint directly passes the user-supplied `issuerUrl` parameter into a fetch operation (`fetch('${issuerUrl}/.well-known/openid-configuration')`) without DNS-rebinding protection, IP address validation, or authentication checks. An unauthenticated attacker can exploit this in two ways: (1) Blind SSRF via error-based information disclosure by targeting non-JSON services (closed ports, SSH, databases), which triggers parsing failures that leak internal service state through error messages; (2) Full data feed SSRF by targeting internal HTTP services that respond with valid JSON, allowing the attacker to exfiltrate or manipulate OpenID configuration properties. The attack vector is network-based with no authentication required, and can access loopback addresses (127.0.0.1, ::1) and private ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12). The advisory indicates no patch is currently available.
Affected products
- decolua 9Router <= 0.5.4
Timeline
- 2026-07-16: disclosed: GitHub Advisory published
- 2026-08-17: advisory: Advisory updated on GitHub Advisory Database