The POST /api/provider-nodes/validate endpoint in decolua 9router (<=0.5.55) accepts a baseUrl parameter and performs server-side HTTP requests to it. The SSRF protection uses assertPublicUrl, which only compares hostname strings without DNS resolution or redirect revalidation. This allows bypasses using IPv4-mapped IPv6 addresses because the URL parser canonicalizes these addresses in a way that the guard's regex never matches, permitting requests to loopback and link-local metadata addresses. Additionally, hostnames with A records pointing to internal IPs bypass the guard since no DNS resolution is done. The vulnerability leaks up to 200 bytes of internal response bodies for certain HTTP status codes, enabling information disclosure. The apiKey parameter is forwarded as an Authorization Bearer header to the internal service. Authentication is required by default but can be disabled, increasing risk. No official patch or remediation level is currently documented.

An attacker with at least dashboard session privileges (or if requireLogin is disabled, no authentication) can exploit this SSRF vulnerability to make unauthorized HTTP requests from the server to internal network resources, including loopback and link-local addresses. This can lead to unauthorized access to internal services, partial disclosure of internal response data, and blind internal port scanning. The forwarding of the apiKey as an Authorization header may allow privilege escalation or unauthorized access to internal APIs. The vulnerability has a high severity with a CVSS score of 8.5, indicating significant confidentiality impact and some integrity impact but no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint by enforcing authentication and authorization controls, especially ensuring requireLogin is enabled. Avoid exposing the apiKey parameter to untrusted users. Monitor for unusual internal requests originating from the 9router server. Consider network-level restrictions to prevent the server from making unauthorized internal requests. Follow vendor advisories closely for updates and apply patches promptly once released.