Summary
A server-side request forgery vulnerability in SciPhi-AI R2R allows a remote attacker to influence the LLM completion configuration and cause the server to make requests to attacker-selected destinations. The issue becomes risky when the Retrieval Completion API accepts a user-controlled api_base value without sufficiently restricting outbound requests.
Affected context
The vulnerability occurs in R2R deployments using the Retrieval Completion API and the code path that processes generation_config.api_base in py/shared/abstractions/llm.py. Exploitation depends on the endpoint accepting attacker-influenced configuration and the server having network connectivity to internal, local, or otherwise restricted destinations.
Exploit preconditions
- Attack surface: The remotely accessible Retrieval Completion API endpoint
- Required access: Ability to submit requests to the affected API, subject to the deployment's authentication and authorization controls
- Trigger point: Processing of a request containing a manipulated
generation_config.api_basevalue - Why exploitation is possible: The server may use an insufficiently validated, attacker-controlled URL as an outbound request destination
Why this happens
The underlying bug is an insufficient separation between trusted service configuration and request-controlled network destinations. When the application accepts an externally influenced API base and uses it for server-side communication without strict destination validation, an attacker can redirect requests through the application. This behavior maps to CWE-918, Server-Side Request Forgery.
Potential impact
- The server may access internal services that are not directly reachable by the attacker.
- Sensitive metadata, service responses, or credentials could be exposed if they are returned or processed by the application.
- Cloud instance metadata or administrative endpoints could be targeted where network controls permit access.
- The application could be used to reach external systems or perform unintended outbound requests.
- Internal network reconnaissance or follow-on compromise could become possible.
General mitigation guidance
Mitigation generally focuses on preventing request-controlled values from
selecting arbitrary outbound destinations.
Common defensive patterns include:
- Allowlisting approved API hosts, schemes, ports, and connection paths.
- Rejecting loopback, link-local, private, multicast, and otherwise restricted address ranges after DNS resolution.
- Rechecking destinations after redirects and preventing DNS rebinding where practical.
- Keeping provider endpoints in trusted server-side configuration rather than accepting them from clients.
- Applying egress network policies, proxy controls, and least-privilege service permissions.
- Returning minimal upstream responses and avoiding disclosure of internal request details.
How teams detect issues like this
Organizations commonly detect SSRF risks through:
- Static analysis and code review searches for request clients that consume URL or host values derived from API parameters.
- Review signals such as unrestricted
api_base, URL concatenation, automatic redirect following, or missing private-address checks. - Runtime monitoring of outbound requests from the R2R service, including destinations, DNS results, redirects, and unusual access to metadata or internal ranges.
- Egress firewall and service-mesh policies that alert on or block unauthorized destinations.
- Automated security review tools and SSRF-focused testing in CI environments using controlled endpoints.
