CVE-2025-27600: FastGPT SSRF Vulnerability

CVE-2025-27600 Overview

CVE-2025-27600 is a Server-Side Request Forgery (SSRF) vulnerability in FastGPT, a knowledge-based platform built on Large Language Models (LLMs). The web crawling plugin fails to validate intranet IP addresses in user-supplied URLs. Attackers can supply internal IP addresses to force the server to issue requests against internal network resources. This behavior can expose private data reachable from the FastGPT host. The issue is tracked under [CWE-918] and is fixed in FastGPT version 4.9.0.

Critical Impact
Unauthenticated attackers can pivot through the FastGPT web crawler to reach internal services and retrieve private intranet data.

Affected Products

FastGPT versions prior to 4.9.0
FastGPT web crawling plugin component
Deployments exposing the crawler feature to untrusted users

Discovery Timeline

2025-03-06 - CVE-2025-27600 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27600

Vulnerability Analysis

FastGPT integrates a web crawling plugin that fetches remote URLs on behalf of users to ingest content into knowledge bases. The plugin accepts an arbitrary URL parameter and issues an outbound HTTP request from the FastGPT server. The crawler does not validate whether the resolved destination is a private, loopback, or link-local address before dispatching the request.

An attacker submits a URL pointing to an intranet IP such as 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16. The server issues the request from its own network position and returns response content to the attacker. This grants access to internal HTTP services, cloud metadata endpoints, and unauthenticated administrative interfaces reachable from the FastGPT host.

Root Cause

The root cause is missing destination address validation in the web crawling plugin. The plugin trusts the user-provided URL without resolving the hostname and comparing the result against a deny list of private address ranges. This omission fits the classic SSRF pattern described in [CWE-918].

Attack Vector

Exploitation requires network access to the FastGPT web interface and the ability to invoke the crawler. No authentication or user interaction is required based on the CVSS vector. The attacker supplies a target URL, and the FastGPT server performs the request and returns the response body or status information to the attacker.

See the FastGPT GitHub Security Advisory GHSA-vc67-62v5-8cwx for vendor-authored technical details.

Detection Methods for CVE-2025-27600

Indicators of Compromise

Outbound HTTP requests from the FastGPT service to RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254
Crawler job entries referencing internal hostnames, cloud metadata endpoints, or non-public URLs
Unexpected access log entries on internal services originating from the FastGPT host IP

Detection Strategies

Inspect FastGPT application logs for crawler invocations whose target URLs resolve to private IP ranges
Correlate FastGPT egress traffic with internal service access logs to identify SSRF probing patterns
Alert on requests from FastGPT to cloud instance metadata services such as 169.254.169.254

Monitoring Recommendations

Deploy egress filtering and log all outbound connections from FastGPT to detect anomalous internal destinations
Monitor for high-volume or scanning-style crawler jobs targeting sequential internal IP addresses
Track authentication logs on internal services for requests sourced from the FastGPT server

How to Mitigate CVE-2025-27600

Immediate Actions Required

Upgrade FastGPT to version 4.9.0 or later to apply the vendor fix
Restrict network egress from the FastGPT host to only required external destinations
Audit historical crawler jobs for requests targeting internal IP ranges or metadata endpoints

Patch Information

The vendor released a fix in FastGPT 4.9.0 that adds intranet IP validation to the web crawling plugin. Refer to the FastGPT GitHub Security Advisory GHSA-vc67-62v5-8cwx for the authoritative patch reference and upgrade guidance.

Workarounds

Place FastGPT behind an egress proxy that blocks connections to RFC1918, loopback, and link-local addresses
Restrict access to the crawler feature to authenticated, trusted users through upstream access controls
Apply firewall rules preventing the FastGPT host from reaching cloud metadata endpoints such as 169.254.169.254

bash

# Example iptables rules blocking FastGPT egress to private ranges
iptables -A OUTPUT -m owner --uid-owner fastgpt -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fastgpt -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fastgpt -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fastgpt -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner fastgpt -d 127.0.0.0/8 -j REJECT