This vulnerability in AstrBotDevs AstrBot up to version 4.25.2 involves the get_online_plugins function in the market_list endpoint. By manipulating the custom_registry argument, an attacker can trigger server-side request forgery (SSRF), causing the server to make unintended HTTP requests. The vulnerability is remotely exploitable and has a CVSS 4.0 base score of 5.3, indicating medium severity. No official remediation or patch has been provided by the vendor, and public exploit code is available.

Successful exploitation allows an attacker to induce the server to send crafted HTTP requests to arbitrary destinations, potentially bypassing network restrictions or accessing internal resources. This can lead to information disclosure or further attacks depending on the internal network environment. The medium CVSS score reflects limited privileges required and low complexity, but with potential for partial impact on confidentiality, integrity, and availability.

No official fix or patch is currently available from the vendor. Users should apply strict input validation and sanitization on the custom_registry parameter if possible, or disable the vulnerable functionality until a patch is released. Monitor for unusual outbound requests from the server that could indicate exploitation attempts. Check the vendor advisory regularly for updates or official remediation.