Executive brief
Sim is a collaborative platform for building and deploying AI workflows. An authenticated workflow author can bypass the system's security checks that are meant to prevent requests to sensitive internal APIs by crafting a specially formatted URL. This allows them to reach restricted internal endpoints and execute unauthorized code, potentially compromising the integrity of workflows and data processed through the platform.
Technical details
The vulnerability is a confused deputy attack (CWE-441) arising from improper internal route classification. Sim determines whether a URL is internal by checking if it starts with the string "/api/" without normalizing the scheme, allowing a user-controlled HTTP block URL to be misclassified as internal. When classified as internal, the request bypasses SSRF/DNS validation and receives a server-minted internal authentication JWT token via generateInternalToken(). An authenticated workflow author can exploit this to reach internal-only endpoints like POST /api/function/execute without the intended security checks. The bypass is confined to the application's own origin since path-based URL resolution cannot change the host, but the attacker can access endpoints using their own elevated privileges within the internal API surface. The root cause is that route classification is driven by string matching on user-supplied input rather than a trusted flag set by the application.
Affected products
- Sim Studio AI Sim before 0.8.14
Timeline
- 2026-06-12: disclosed
- 2026-06-30: patched