CVE-2023-49785

Summary

CVE-2023-49785 is a serious vulnerability affecting NextChat, also known as ChatGPT-Next-Web, a cross-platform chat user interface for ChatGPT. Versions 2.11.2 and prior of NextChat are susceptible to both server-side request forgery and cross-site scripting. These vulnerabilities grant attackers read access to internal HTTP endpoints, as well as write access using HTTP POST, PUT, and other methods. An attacker can exploit this vulnerability to mask their IP address and forward malicious traffic through open proxies. At the time of publication, no patch is available, but users can mitigate risk by avoiding public exposure of the application or ensuring it is isolated on a secure network with no access to internal resources.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.