Critical · published December 2, 2025
⚠️ Cleverly disguised as a harmless header, the x-portkey-custom-host can be the key to a sneaky SSRF attack before version 1.14.0 of Portkey.ai Gateway. 🚪 Imagine ordering a package and telling the delivery person to take a shortcut through all the restricted areas—this vulnerability allows an attacker to specify where the request goes, potentially fetching sensitive internal resources. An attacker could exploit this vulnerability to send requests to any internal service, snooping around your network like a cat burglar in a house full of valuables. While this isn't a catastrophic breach, it could lead to data leaks or unauthorized access that could be absolutely devastating to your security posture.
Imagine ordering a package and telling the delivery person to take a shortcut through all the restricted areas—this vulnerability allows an attacker to specify where the request goes, potentially fetching sensitive internal resources. The vulnerability arises from the gateway's incorrect prioritization of the x-portkey-custom-host header, allowing attackers to redirect requests to unintended destinations through SSRF exploits.
An attacker could exploit this vulnerability to send requests to any internal service, snooping around your network like a cat burglar in a house full of valuables. While this isn't a catastrophic breach, it could lead to data leaks or unauthorized access that could be absolutely devastating to your security posture. Patch to version 1.14.0 immediately to close off this vector. Additionally, consider auditing the handling of request headers to ensure stricter validation on incoming requests. This is fixable! Get that patch in place, and you’ll be a security hero in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| portkey/gateway | < 1.14.0 | 1.14.0 |