Summary
TREK before 3.3.0 allows an authenticated user with write access to a trip to store an attacker-controlled LLM endpoint when LLM-assisted parsing is enabled. When the AI-assisted import path uses that endpoint, the server may access internal services or cloud metadata, and response details may be exposed through parsing warnings.
Affected context
The issue occurs in TREK deployments where the LLM_PARSING feature is enabled and a user can modify settings for a trip they can edit. The affected AI client and routing components consume the configured LLM base URL without applying the server-side request forgery protection used elsewhere, allowing server-originated requests to follow an attacker-selected destination.
Exploit preconditions
- Attack surface: TREK settings and AI-assisted trip import functionality
- Required access: An authenticated account with write permission to the target trip
- Configuration requirement: The LLM_PARSING feature must be enabled
- Trigger point: AI-assisted trip parsing after the attacker-controlled LLM endpoint is stored
- Why exploitation is possible: The server makes outbound requests to the configured destination without enforcing SSRF restrictions, and upstream error text may be included in parsing warnings
Why this happens
The vulnerability results from trusting a user-controlled URL as an outbound service endpoint without applying a server-side request forgery guard. This insecure pattern allows application-controlled network requests to reach destinations that may be inaccessible to the user directly, including internal services and link-local cloud metadata endpoints. The behavior maps to CWE-918: Server-Side Request Forgery.
Potential impact
- Internal service discovery could occur
- Link-local cloud metadata may be accessed
- Infrastructure credentials or other sensitive metadata could be disclosed
- Protected cloud resources could be modified if exposed credentials have sufficient privileges
- Parsing warnings could reveal upstream response information
General mitigation guidance
Mitigation generally focuses on reducing trust in user-supplied network destinations and enforcing outbound request policy.
Common defensive patterns include:
- Allowing requests only to explicitly approved LLM providers or hosts
- Validating and canonicalizing destinations before making outbound requests
- Blocking loopback, link-local, private, and otherwise restricted network ranges after DNS resolution
- Applying SSRF protections consistently across every AI client and routing path
- Limiting response details returned in user-visible parsing warnings
- Running outbound requests through isolated network controls or an egress proxy
- Using least-privilege service identities so exposed credentials cannot modify protected resources
How teams detect issues like this
Organizations can look for SSRF exposure through:
- Static analysis rules identifying user-controlled URLs passed to HTTP clients
- Code review checks for missing destination validation, DNS rebinding defenses, or network-range restrictions
- Inventory and policy enforcement for application egress destinations
- Runtime monitoring of requests from TREK services to private, loopback, link-local, or metadata addresses
- Logging and alerting on unusual LLM endpoint changes and unexpected upstream error content
- Automated security review tools that flag server-side requests derived from mutable user settings
