Unauthenticated SSRF in stoatchat Proxy Endpoints

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and reach instance metadata endpoints by supplying malicious URLs or leveraging redirect chains to access internal infrastructure.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

stoatchat versions before 0.13.5 contain a critical server-side request forgery (SSRF) vulnerability in the /proxy and /embed endpoints that fail to validate or filter URLs before processing them. This vulnerability allows unauthenticated attackers to abuse the application as a proxy to reach internal services, scan private IP ranges, enumerate application configurations, and access sensitive metadata endpoints—potentially leading to credential exposure, lateral movement, or cloud infrastructure compromise. Any organization running vulnerable stoatchat instances with these endpoints exposed faces immediate risk of information disclosure and unauthorized access to internal resources.

Casky's 331 mapped skills detect the attack patterns associated with this vulnerability by analyzing reconnaissance and initial access behaviors through MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0006 (Resource Development). Practitioners using Casky would observe detection signals for suspicious URL patterns submitted to /proxy and /embed endpoints—including requests targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost addresses, cloud metadata services (169.254.169.254), and DNS rebinding attempts. Claude's extended reasoning capability correlates multiple indicators: absence of authentication headers, repeated failed connection attempts to internal IPs, sudden shifts from external to internal traffic patterns, and redirect chain sequences that bypass simple URL validation. These findings help practitioners identify exploitation attempts before internal infrastructure is compromised, enabling rapid response to active reconnaissance or metadata endpoint abuse.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-63306.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-63306

Casky has 331 skills that investigate the attack patterns behind CVE-2026-63306. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn