Description
NextChat 是一款个人化的 ChatGPT 聊天机器人工具。该漏洞存在于 /api/cors 接口中，攻击者可以通过构造恶意的 URL，利用服务端请求伪造（SSRF）漏洞，访问内部网络或敏感资源，可能导致敏感信息泄露或进一步的攻击。
NextChat /api/cors 服务器端请求伪造漏洞（CVE-2023-49785）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-49785
https://github.com/advisories/GHSA-qf3q-9f3h-cjp9
https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to/
https://www.vicarius.io/vsociety/posts/hacking-ai-chatbots-for-fun-and-learning-analyzing-an-unauthenticated-ssrf-and-reflected-xss-in-chatgpt-next-web-cve-2023-49785
https://www.cnblogs.com/hetianlab/p/18177961
https://segmentfault.com/a/1190000044861767
https://www.anquanke.com/post/id/293868
https://xsx.tw/exploit/3484/
https://cn-sec.com/archives/2574562.html
https://www.tenablecloud.cn/plugins/was/114306
https://www.s2w.inc/en/resource/detail/720
https://cloud.tencent.com/developer/article/2413463