Executive brief
Coze Studio is an AI agent development platform that allows users to register plugin tools. The platform fails to validate server URLs when registering plugins, enabling authenticated users to perform server-side request forgery (SSRF) attacks. An attacker can craft malicious plugin requests to access internal cloud metadata services and backend-only services, potentially exposing sensitive credentials and configuration data.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) flaw in the plugin tool registration mechanism. The backend service fails to restrict or validate the server URL supplied when users register plugin tools, allowing authenticated attackers to specify arbitrary URLs. An attacker with valid credentials can construct plugin invocation requests that force the backend to fetch from cloud metadata endpoints (e.g., AWS, GCP metadata services) or internal services that are only accessible from the backend network. The vulnerable code path is in backend/domain/plugin/service/tool/invocation_http.go. While the vulnerability requires authentication, an attacker can read sensitive information from the responses, including API credentials and internal service data. A patch restricting URL allowlists or implementing proper validation is expected to address this issue.
Affected products
- Coze Studio through 0.5.1
Timeline
- 2026-09-16: disclosed