CVE-2025-62155: New API LLM Gateway SSRF Vulnerability

CVE-2025-62155 Overview

CVE-2025-62155 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in New API, a large language model (LLM) gateway and artificial intelligence (AI) asset management system. The flaw affects all versions prior to 0.9.6 and bypasses a previously applied SSRF security fix. The original patch validated only the first URL request, allowing an attacker-controlled server to return an HTTP 302 redirect to an internal address. The redirected request reaches internal network resources without further validation.

Critical Impact
Authenticated attackers can bypass SSRF protections through HTTP 302 redirects to reach intranet services, exposing internal infrastructure and metadata endpoints.

Affected Products

New API (QuantumNous/new-api) versions prior to 0.9.6
LLM gateway deployments using New API for AI asset management
Self-hosted New API instances exposed to authenticated users

Discovery Timeline

2025-11-25 - CVE-2025-62155 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-62155

Vulnerability Analysis

The vulnerability resides in the URL validation logic that was introduced as a fix for a prior SSRF issue in New API. The original mitigation enforced security restrictions only on the initial outbound HTTP request. The HTTP client follows redirects without re-validating the destination. An attacker submits a URL pointing to an external server they control. That server responds with a 302 redirect to an internal address such as http://127.0.0.1, http://169.254.169.254, or other intranet hosts. The redirected request executes against the internal target with the application's network privileges.

Root Cause

The root cause is incomplete input validation on the redirect chain. The SSRF protection function inspects only the user-supplied URL and does not hook into the HTTP client's redirect handler. Each subsequent Location header response is treated as trusted, breaking the security boundary. This is a classic pattern documented under CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires low-privilege authenticated access to a New API endpoint that fetches remote resources. The attacker hosts a redirect responder on a public domain. They submit the public URL to the vulnerable endpoint. New API performs the initial request, receives the 302 response, and follows it to the internal target. The attacker reads the response or triggers side effects on internal services including cloud metadata APIs, Redis instances, or internal admin panels.

No verified exploit code is published. For technical details, see the GitHub Security Advisory GHSA-9f46-w24h-69w4.

Detection Methods for CVE-2025-62155

Indicators of Compromise

Outbound HTTP requests from the New API service to external domains followed immediately by requests to RFC1918 ranges or 169.254.169.254
HTTP 302 responses logged in New API outbound proxy logs originating from untrusted hosts
Unexpected access patterns to internal service ports (Redis 6379, etcd 2379, cloud metadata 80) from the New API process
Application logs showing user-submitted URLs that resolve to single-use redirect services

Detection Strategies

Inspect HTTP client logs from the New API process for redirect chains crossing trust boundaries from public to private IP space
Deploy egress network monitoring to flag connections from the API host to link-local or private address ranges
Correlate authenticated user actions in New API audit logs with outbound network telemetry to identify abuse

Monitoring Recommendations

Alert on any access from application hosts to 169.254.169.254 or internal management interfaces
Baseline normal outbound destinations for the New API service and alert on deviations
Monitor for 302 response codes returned to the New API HTTP client from non-allowlisted domains

How to Mitigate CVE-2025-62155

Immediate Actions Required

Upgrade New API to version 0.9.6 or later, which applies validation across the entire redirect chain
Restrict egress network access from New API hosts to only required external endpoints using firewall or proxy rules
Block outbound connections from the API service to RFC1918 ranges and cloud metadata IP addresses
Audit recent New API request logs for suspicious URL submissions and redirect activity

Patch Information

The vulnerability is patched in New API version 0.9.6. The fix applies SSRF security checks to each URL in the redirect chain rather than only the initial request. Administrators should pull the latest release from the QuantumNous/new-api repository and redeploy.

Workarounds

Disable HTTP redirect following in the New API HTTP client configuration where possible
Deploy an egress proxy that enforces destination allowlisting for all outbound requests from the API service
Place the New API service in a network segment with no route to internal management networks or cloud metadata endpoints
Restrict the user roles permitted to submit URLs for remote fetching until the patch is applied

bash

# Example iptables egress restriction for the New API host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT