# FastGPT Workflow File-Read Node SSRF Link

- **Severity:** High
- **Signature ID:** `9c4f1e6a-3b57-4d82-a1f0-7e5c8b2d4a91`

## Summary

FastGPT lets workflows include a 'file reading' node that fetches a file from a URL. Versions before 4.11.1 don't check where that URL points, so an attacker can point it at internal addresses instead of a real file, tricking the FastGPT server into making requests on the attacker's behalf.

## How the attack works

An attacker builds or submits a FastGPT workflow containing a file-read node (readFiles / fileUrlList) and sets its target link to something other than a normal public file URL — a loopback address, a link-local or cloud metadata address, an RFC1918 internal IP, an internal-only domain, or a non-HTTP scheme. FastGPT's backend does not validate this target before fetching it. When the workflow runs, the FastGPT server itself issues the request, effectively using its network position to reach hosts the attacker could not reach directly. The same trick also works if the internal target is passed as a fileUrl/fileUrlList query parameter rather than inside the workflow body.

## Why it matters

An attacker can use the FastGPT server as a proxy to probe or reach internal-only services, and potentially pull cloud instance metadata (which often includes credentials), from outside the trust boundary that would normally block direct access.

## What you can do

- Upgrade FastGPT to 4.11.1 or later, where the file reading node validates fetch targets.
- If upgrading isn't immediately possible, block or filter outbound requests from the FastGPT server to loopback, link-local, RFC1918, and cloud metadata addresses at the network level.
- Review workflow definitions for file-read nodes with unexpected internal or non-HTTP-scheme URLs.
- For single-host or docker-compose deployments, confirm any 127.0.0.1/RFC1918 file-read targets genuinely belong to the instance's own co-located storage service before treating them as benign.

## Known benign look-alikes

- Single-host / docker-compose FastGPT installs where the file reading node legitimately pulls from the instance's own co-located object store or file service on 127.0.0.1 or an RFC1918 address (e.g. a bundled MinIO). Confirm the port and path belong to the deployment's own storage service.
- CI or local development runs that execute FastGPT workflow tests against a dev server on 127.0.0.1 / localhost.
- Security advisories, pentest reports and regression fixtures that embed the SSRF proof-of-concept payload; the common phrasing is suppressed by filter_vuln_documentation, but a report that omits the CVE identifier or the phrase "server-side request forgery" will still match.
- Exported or template workflows whose fileUrlList contains only unresolved {{variables}}; suppressed by filter_placeholder_only.

## References

- https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/
- https://github.com/labring/FastGPT/releases

---
Source: https://www.netzilo.com/threats/fastgpt-workflow-file-read-ssrf