Fastgpt EUVD-2026-17447

FastGPT versions prior to 4.14.9.5. Authenticated user access required. Attacker exploits /api/core/app/mcpTools/getTools or /api/core/app/mcpTools/runTool endpoints by supplying malicious internal network URLs. MCP tools feature must be available. No victim interaction needed.

Real-world risk is HIGH despite requiring low-privilege authentication (PR:L). The CVSS 7.7 score with scope change (S:C) and high confidentiality impact (C:H) accurately reflects the severity. Attack complexity is low (AC:L) with network attack vector (AV:N), meaning any authenticated user can trivially exploit this remotely. No public exploit identified at time of analysis, though GitHub security advisory GHSA-x9vj-5m4j-9mfv provides detailed technical disclosure that functions as proof-of-concept guidance. The vulnerability enables multiple high-impact attack paths: exfiltration of cloud instance credentials (AWS/Azure/GCP metadata endpoints), reconnaissance of internal network topology, and direct interaction with unsecured internal services like Redis and MongoDB which often lack authentication on private networks. For organizations running FastGPT in cloud environments or with sensitive internal services, this represents a critical privilege escalation pathway from application-level access to infrastructure compromise. The SSVC framework would classify this as requiring immediate attention: exploitation status is public (PoC available), automatable (simple HTTP requests), and technical impact is total (credential theft enables full infrastructure access). Priority should be elevated for internet-facing deployments.

An authenticated attacker with low-privilege credentials logs into FastGPT and sends a crafted POST request to /api/core/app/mcpTools/runTool with a URL parameter pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS metadata service). The server executes the request without validation and returns temporary AWS credentials with permissions tied to the instance IAM role. The attacker extracts these credentials from the response and uses them to access S3 buckets, RDS databases, or other AWS resources outside the application's intended scope. Alternatively, the attacker targets internal Redis instances at redis://10.0.1.50:6379 to read cached session tokens or MongoDB at mongodb://10.0.2.100:27017 to dump application databases, achieving full data exfiltration through SSRF-as-a-proxy abuse.