SSRF Flaws Could Expose Internal Networks Through AI Tools

Summary

The video describes SSRF weaknesses found in AI tools associated with Google, JPMorgan Chase, and two unnamed governments. Redirect handling or inadequate address checks could let tools access internal addresses and, depending on configuration, cloud credential-related.

Key points

• A hacker reportedly found SSRF weaknesses in AI tools associated with Google, JPMorgan Chase, and two unnamed governments.
• One tool could follow a page-fetch request through a redirect to an unintended destination; another reportedly fetched addresses without properly checking them.
• These flaws could make a server access internal addresses that a user could not reach directly.
• Depending on configuration, the tools could potentially reach cloud endpoints that provide credentials.