Skip to content
Fencer Vulns
critical 9.1

CVE-2023-49785 in the critical feed json

NextChat vulnerable to Server-Side Request Forgery and Cross-site Scripting

published 2024-03-11 2 y ago modified 2026-06-17 4 mo ago also GHSA-qf3q-9f3h-cjp9 , EUVD-2024-2633

cvss
9.1
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
83.2%
EPSS 83.2% chance of exploitation in 30 days, percentile 99.6%
public exploits
0
none known, plus a Nuclei check

Summary

NextChat, also known as ChatGPT-Next-Web, is a cross-platform chat user interface for use with ChatGPT. Versions 2.11.2 and prior are vulnerable to server-side request forgery and cross-site scripting. This vulnerability enables read access to internal HTTP endpoints but also write access using HTTP POST, PUT, and other methods. Attackers can also use this vulnerability to mask their source IP by forwarding malicious traffic intended for other Internet targets through these open proxies. As of time of publication, no patch is available, but other mitigation strategies are available. Users may avoid exposing the application to the public internet or, if exposing the application to the internet, ensure it is an isolated network with no access to any other internal resources.

Patch / fix

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

83.16% chance of exploitation in the next 30 days, higher than 99.6% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Nuclei template ChatGPT-Next-Web - SSRF/XSS nuclei detection template
  • github.com https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/pull/4285 referenced PoC, tagged "exploit" by a source, unverified
  • horizon3.ai https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to/ referenced PoC, tagged "exploit" by a source, unverified
  • vicarius.io https://www.vicarius.io/vsociety/posts/hacking-ai-chatbots-for-fun-and-learning-analyzing-an-unauthenticated-ssrf-and-reflected-xss-in-chatgpt-next-web-cve-2023-49785 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web/issues/4283 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
npm nextchat
<=2.11.2
 no fix listed

Affected products

  • ChatGPTNextWeb NextChat

Classification

Weakness
  • CWE-918 Server-Side Request Forgery
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.