You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@rocketmq.apache.org by "youngkermit8-coder (via GitHub)" <gi...@apache.org> on 2026/08/11 09:45:38 UTC

[I] [Studio][Security] Restrict LLM connection tests to administrators [rocketmq-dashboard]

youngkermit8-coder opened a new issue, #1712:
URL: https://github.com/apache/rocketmq-dashboard/issues/1712

   ### Description
   
   `AuthInterceptor.READER_POST_PATHS` currently includes `/api/llm/config/test`. An authenticated non-admin reader can therefore submit an arbitrary LLM `apiBase` and cause the Studio backend to initiate a connection to that caller-controlled destination. Saving LLM configuration is admin-only, and data-source connection tests are already admin-only for the same trust-boundary reason.
   
   ### Expected behavior
   
   Only administrators should be able to invoke the LLM configuration test endpoint. Reader access to normal AI chat remains unchanged.
   
   ### Reproduction
   
   1. Enable login and authenticate as a non-admin user.
   2. POST a valid LLM configuration to `/api/llm/config/test`.
   3. Observe that the auth interceptor allows the request instead of returning HTTP 403.
   
   ### Proposed fix
   
   Remove `/api/llm/config/test` from the reader POST allowlist and add an authorization regression test.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Restrict LLM connection tests to administrators [rocketmq-dashboard]

Posted by "RockteMQ-AI (via GitHub)" <gi...@apache.org>.

RockteMQ-AI commented on issue #1712:
URL: https://github.com/apache/rocketmq-dashboard/issues/1712#issuecomment-5251746859

**Issue Evaluation**

Category: `type/bug` (security) | Severity: **High** | Status: **Confirmed**

This is a server-side request forgery (SSRF) risk. `AuthInterceptor.READER_POST_PATHS` includes `/api/llm/config/test`, which allows any authenticated non-admin reader to submit an arbitrary `apiBase` URL and cause the Studio backend to initiate an outbound connection to that caller-controlled destination.

**Root Cause:** The LLM connection test endpoint was incorrectly placed in the reader POST allowlist. Saving LLM configuration is already admin-only, and data-source connection tests follow the same admin-only pattern for this exact trust-boundary reason.

**Impact:** Non-admin users can trigger the backend to connect to arbitrary URLs, potentially probing internal services or exfiltrating data through SSRF.

**Proposed Fix Assessment:** Removing `/api/llm/config/test` from `READER_POST_PATHS` and adding an authorization regression test is the correct minimal fix.

This is a valid security issue. A fix PR is welcome.

---
*Automated evaluation by github-manager*

--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Restrict LLM connection tests to administrators [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] commented on issue #1712:
URL: https://github.com/apache/rocketmq-dashboard/issues/1712#issuecomment-5723048197

   This issue has been automatically closed because there has been no activity for 7 days. If you believe this issue is still relevant, please reopen it with updated information.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [I] [Studio][Security] Restrict LLM connection tests to administrators [rocketmq-dashboard]

Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.

github-actions[bot] closed issue #1712: [Studio][Security] Restrict LLM connection tests to administrators
URL: https://github.com/apache/rocketmq-dashboard/issues/1712


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@rocketmq.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org