PT-2023-8836 · Nextchat · Nextchat

🗓️ 25 Nov 2023 00:00:00Reported by Positive TechnologiesType

NextChat versions 2.11.2 and earlier suffer server-side request forgery and cross-site scripting, exposing internal endpoints.

Reporter	Title	Published	Views	Family All 16
Circl	CVE-2023-49785	12 Mar 202401:26	–	circl
CNNVD	NextChat Code Issue Vulnerability	11 Mar 202400:00	–	cnnvd
CVE	CVE-2023-49785	11 Mar 202423:26	–	cve
Cvelist	CVE-2023-49785 NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting	11 Mar 202423:26	–	cvelist
Github Security Blog	NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint	5 Aug 202421:29	–	github
Tenable Nessus	NextChat < 2.11.3 SSRF	29 Apr 202400:00	–	nessus
Tenable Nessus	NextChat < 2.11.3 SSRF	29 Apr 202400:00	–	nessus
Tenable Nessus	NextChat < 2.11.3 Server-Side Request Forgery	20 Jun 202400:00	–	nessus
Nuclei	ChatGPT-Next-Web - SSRF/XSS	1 Jun 202605:38	–	nuclei
NVD	CVE-2023-49785	12 Mar 202400:15	–	nvd

Source	Link
github	www.github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/4283
vicarius	www.vicarius.io/vsociety/posts/hacking-ai-chatbots-for-fun-and-learning-analyzing-an-unauthenticated-ssrf-and-reflected-xss-in-chatgpt-next-web-cve-2023-49785
horizon3	www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to
github	www.github.com/ChatGPTNextWeb/ChatGPT-Next-Web/pull/4285
bdu	www.bdu.fstec.ru/vul/2024-02148
nvd	www.nvd.nist.gov/vuln/detail/CVE-2023-49785
osv	www.osv.dev/vulnerability/CVE-2023-49785
osv	www.osv.dev/vulnerability/GHSA-qf3q-9f3h-cjp9
github	www.github.com/ChatGPTNextWeb/ChatGPT-Next-Web
twitter	www.twitter.com/Horizon3ai/status/1768005870065991733

04 Dec 2024 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 3.19.1 - 9.8

EPSS0.90439

SSVC