Summary

AI Engine by Jordy Meow versions up to 2.1.4 is vulnerable to an authenticated Server-Side Request Forgery (SSRF) vulnerability. This post drills down into the depths of this vulnerability presenting you the complete exploit, root cause analysis, bonus trick to fetch the responses to the SSRF requests, as well as the mitigations done to prevent this issue. We close with some general thoughts as well as some unique personal insights that I have regarding bugs in AI products, in general. This post is a complete package for those who wish to understand the process of going from the vulnerability description to having the fully functional exploit, by performing manual code reviews!

Description