Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

chatgptnextweb/nextchat

              main @ 89b8f26
            

Fixes

CVEs

CRITICAL

Peak severity

30.8%

Coverage

Highlights

SSRF: 9 prior fixes. Scrutinize any change in this area.

app/api/webdav/[...path]/route.ts: most-fixed (4 issues). Treat as high-risk during review.

14 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

SSRF: The WebDAV proxy endpoint failed to validate target hosts properly and followed redirects blindly, allowing attackers to route requests internally or leak credentials. Mitigations required strict host/pathname matching instead of simple prefix checks and disabling automatic redirects.

SSRF: An open CORS proxy API route allowed arbitrary SSRF and proxying of requests to external or internal hosts, requiring the complete removal of the route and disabling vulnerable HTTP methods. This class of full-read SSRF is a recurring critical risk as evidenced by CVE-2023-49785.

Auth Bypass: Authentication checks were bypassed due to weak logic, such as misidentifying user access tokens, failing to block custom API keys when configured to restrict usage to only the system-provided key, or failing to call authentication guards in parallel API proxy routes.