Executive brief
9Router, a tool used for web content fetching and routing, contains a security flaw that allows users to trick the server into accessing internal systems. An attacker can use this to steal sensitive cloud credentials, access private databases, or reach internal services that are not supposed to be visible from the internet. This could lead to a significant data breach or unauthorized access to the organization's cloud infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the /v1/web/fetch endpoint of 9Router due to insufficient validation of the 'url' parameter. The application uses 'new URL()' to check syntax but fails to implement a blocklist for private IP ranges (RFC 1918), loopback addresses, or cloud metadata services (e.g., 169.254.169.254). An authenticated attacker can provide an internal URL which the server then fetches via configured scraping providers (Firecrawl, Jina, etc.), returning the response content to the attacker. This enables read-access SSRF, potentially leading to the theft of IAM credentials from cloud metadata endpoints or the bypass of authentication on localhost services. The issue is patched in version 0.4.72.
Affected products
- decolua 9router < 0.4.72
Timeline
- 2026-07-03: advisory: GitHub Security Advisory published by vendor
- 2026-07-23: disclosed: CVE published to NVD