This vulnerability affects the iFlytek astron-agent product up to version 1.0.6. Specifically, the UrlCheckTool.checkUrl function in the debugToolV2 API endpoint improperly handles the endPoint argument, enabling an attacker to perform server-side request forgery. The vulnerability can be exploited remotely without user interaction and requires low privileges. The issue is fixed in version reward-1575, with the patch identified by commit 45ee5fb647e9894e73b0d7720fa94a66e4540bbb.

Successful exploitation of this vulnerability allows an attacker to make arbitrary requests from the vulnerable server, potentially accessing internal resources or services that are otherwise inaccessible. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, and limited confidentiality, integrity, and availability impacts.

Upgrade the iFlytek astron-agent component to version reward-1575, which contains the official fix for this SSRF vulnerability. No additional mitigation steps are indicated by the vendor advisory.