Executive brief
9router is an open-source AI routing service that forwards requests to multiple LLM providers. The POST /api/provider-nodes/validate endpoint accepts a user-supplied URL and makes server-side HTTP requests to validate it. Due to flaws in the hostname validation logic, an attacker can bypass security checks to access internal services, link-local metadata endpoints, or loopback addresses on the 9router host itself, potentially exfiltrating credentials or configuration data.
Technical details
This is a server-side request forgery (SSRF) vulnerability in the assertPublicUrl guard function (src/shared/utils/ssrfGuard.js). The guard performs hostname-only validation and fails to account for WHATWG URL canonicalization: IPv4-mapped IPv6 literals like [::ffff:127.0.0.1] are canonicalized to hextets (e.g., [::ffff:7f00:1]) before validation, causing the regex branch that should block them to never match. Additionally, the guard performs no DNS resolution, allowing hostnames with A records pointing to internal IPs to pass, and does not revalidate after redirects. Attackers can reach 127.0.0.1, 169.254.169.254 (AWS metadata), and other internal addresses. The caller-supplied apiKey is forwarded as an Authorization Bearer header to the internal destination, and truncated response bodies (up to 200 bytes) are returned when the upstream status is not 2xx, 401, or 403, enabling information disclosure. Exploitation requires a dashboard session by default (or no authentication if requireLogin is disabled).
Affected products
- decolua 9router <UNKNOWN>
Timeline
- 2026-08-20: disclosed