id: CVE-2026-90603

info:
  name: "Open-Generative-AI - Unauthenticated S3 Upload Proxy"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Anil-matcha Open-Generative-AI through 1.0.11/2.0.0 exposes POST /api/upload-binary (an S3 upload proxy)
    with no authentication. The handler reads the attacker-supplied x-proxy-target-url form field and forwards
    the uploaded file to it, enabling unrestricted upload and server-side request forgery. The fix adds an API
    key gate (401 "Missing API key") before the target is read. This template sends an unauthenticated
    multipart request without the target field; a vulnerable host skips the auth gate and reaches the target
    validation (HTTP 400 "Missing proxy target URL"), whereas a patched host rejects it with 401 first.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-90603&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=open-generative-ai&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
    cvss-score: 9.4
    cve-id: CVE-2026-90603
    cwe-id: CWE-434
  metadata:
    verified: false
  tags: cve,cve2026,open-generative-ai,upload,ssrf,intrusive

variables:
  boundary: "{{rand_text_alphanumeric(18)}}"

http:
  - raw:
      - |
        POST /api/upload-binary HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary={{boundary}}

        --{{boundary}}
        Content-Disposition: form-data; name="probe"

        vedas
        --{{boundary}}--

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 400
      - type: word
        part: body
        words:
          - 'proxy target URL'