🛡️ fix: SSRF-Guard Speech (STT/TTS) and OCR Outbound Requests at Connect Time (#14560)

* fix: SSRF-guard speech (STT/TTS) and OCR outbound requests at connect time

Speech (STT/TTS) and OCR issued outbound HTTP to operator-provided target URLs
with only proxy config attached, so a target that resolves to a private, loopback,
link-local, or cloud-metadata address was reachable by the server. This is the same
class already guarded for the custom models fetch, Actions, avatar, MCP, and the
OpenAI/Anthropic endpoint clients.

Add one helper applySSRFSafeAgentIfDirect(config, url, allowedAddresses) that rejects
non-http(s) or unparseable target URLs, sets maxRedirects to 0 so a redirect cannot
bypass the connect-time check, and attaches createSSRFSafeAgents when no proxy or agent
is already set (proxy precedence preserved). Wire it into the six speech/OCR call sites
and thread each section's allowedAddresses exemption from pr-01.

Scope is private/internal SSRF only. It does not restrict forwarding a credential to a
public host, which is a separate egress-allowlist concern. Absent an allowedAddresses
entry, private targets now fail closed, matching endpoints, actions, and MCP. Document
the new fields in librechat.example.yaml with the operator warning that allowedAddresses
hostnames are trusted before the private-IP check.

* fix: block literal private-IP hosts and thread STT exemptions through generic uploads

applySSRFSafeAgentIfDirect only attached the DNS-lookup agents, but Node
skips the custom lookup for IP-literal hosts, so a literal private IP such
as http://127.0.0.1 connected unchecked. Reject literal private IPs
synchronously in the helper, reusing the same allowedAddresses exemption
logic as the lookup path.

The generic audio-upload path did not forward the section-level
allowedAddresses to sttRequest, so a private STT endpoint permitted via
speech.stt.allowedAddresses failed with ESSRF outside the speech route.
Thread the exemption through files/audio.ts and widen the STTService type.

* fix: derive effective SSRF port for literal IPs and validate OCR target before opening its stream

The literal-IP precheck normalized an empty URL.port to '', so
allowedAddresses exemptions on a default port (127.0.0.1:80, [::1]:443)
never matched. Derive 80/443 from the scheme when the port is omitted.

uploadDocumentToMistral opened the upload file stream before the SSRF
check, so a blocked or malformed target threw with the descriptor still
open. Run the proxy/SSRF setup before fs.createReadStream.

Reword the librechat.example.yaml allowedAddresses guidance to prefer a
private IP literal over a hostname, and reconcile the speech/OCR SSRF
specs to assert the synchronous literal-IP block instead of driving the
connect-time lookup that Node skips for IP literals.

* fix: block literal private IPs before the proxy return, destroy OCR stream on failure, canonicalize IPv6 exemptions

Move the literal-IP check above the proxy/agent early return so a literal
private IP is rejected even when a proxy is configured; document that a
forward proxy must be SSRF-enforcing.

Wrap the Mistral upload post in try/finally and destroy the file stream,
so an async connect-time block does not leak the descriptor.

Canonicalize IP literals in normalizeAddressCandidate through the same URL
serialization targets use, so IPv4-mapped and expanded IPv6 exemptions match.

api/server/services/Files/Audio/STTService.js

@@ -8,6 +8,7 @@ const {
   logAxiosError,
   applyAxiosProxyConfig,
   resolveConfigSecret,
+  applySSRFSafeAgentIfDirect,
 } = require('@librechat/api');
 const { extractEnvVariable, STTProviders } = require('librechat-data-provider');
 const { getAppConfig } = require('~/server/services/Config');
@@ -138,7 +139,7 @@ class STTService {
   /**
    * Retrieves the configured STT provider and its schema.
    * @param {ServerRequest} req - The request object.
-   * @returns {Promise<[string, Object]>} A promise that resolves to an array containing the provider name and its schema.
+   * @returns {Promise<[string, Object, (string[]|undefined)]>} A promise that resolves to the provider name, its schema, and the section-level allowedAddresses exemption list.
    * @throws {Error} If no STT schema is set, multiple providers are set, or no provider is set.
    */
   async getProviderSchema(req) {
@@ -169,7 +170,7 @@ class STTService {
     }
 
     const [provider, schema] = providers[0];
-    return [provider, schema];
+    return [provider, schema, sttSchema.allowedAddresses];
   }
 
   /**
@@ -283,10 +284,11 @@ class STTService {
    * @param {Buffer} requestData.audioBuffer - The audio data to be transcribed.
    * @param {Object} requestData.audioFile - The audio file object containing originalname, mimetype, and size.
    * @param {string} requestData.language - The language code for the transcription.
+   * @param {string[]} [allowedAddresses] - Section-level SSRF exemption list of host:port pairs.
    * @returns {Promise<string>} A promise that resolves to the transcribed text.
    * @throws {Error} If the provider is invalid, the response status is not 200, or the response data is missing.
    */
-  async sttRequest(provider, sttSchema, { audioBuffer, audioFile, language }) {
+  async sttRequest(provider, sttSchema, { audioBuffer, audioFile, language }, allowedAddresses) {
     const strategy = this.providerStrategies[provider];
     if (!strategy) {
       throw new Error('Invalid provider');
@@ -308,6 +310,7 @@ class STTService {
     const options = { headers };
 
     applyAxiosProxyConfig(options, url);
+    applySSRFSafeAgentIfDirect(options, url, allowedAddresses);
 
     try {
       const response = await axios.post(url, data, options);
@@ -347,9 +350,14 @@ class STTService {
     };
 
     try {
-      const [provider, sttSchema] = await this.getProviderSchema(req);
+      const [provider, sttSchema, allowedAddresses] = await this.getProviderSchema(req);
       const language = req.body?.language || '';
-      const text = await this.sttRequest(provider, sttSchema, { audioBuffer, audioFile, language });
+      const text = await this.sttRequest(
+        provider,
+        sttSchema,
+        { audioBuffer, audioFile, language },
+        allowedAddresses,
+      );
       res.json({ text });
     } catch (error) {
       logAxiosError({ message: 'An error occurred while processing the audio:', error });

api/server/services/Files/Audio/TTSService.js

@@ -5,6 +5,7 @@ const {
   logAxiosError,
   applyAxiosProxyConfig,
   resolveConfigSecret,
+  applySSRFSafeAgentIfDirect,
 } = require('@librechat/api');
 const { extractEnvVariable, TTSProviders } = require('librechat-data-provider');
 const { getRandomVoiceId, createChunkProcessor, splitTextIntoChunks } = require('./streamAudio');
@@ -255,10 +256,11 @@ class TTSService {
    * @param {string} options.input - The input text.
    * @param {string} options.voice - The voice to use.
    * @param {boolean} [options.stream=true] - Whether to use streaming.
+   * @param {string[]} [allowedAddresses] - Section-level SSRF exemption list of host:port pairs.
    * @returns {Promise<Object>} The axios response object.
    * @throws {Error} If the provider is invalid or the request fails.
    */
-  async ttsRequest(provider, ttsSchema, { input, voice, stream = true }) {
+  async ttsRequest(provider, ttsSchema, { input, voice, stream = true }, allowedAddresses) {
     const strategy = this.providerStrategies[provider];
     if (!strategy) {
       throw new Error('Invalid provider');
@@ -271,6 +273,7 @@ class TTSService {
     const options = { headers, responseType: stream ? 'stream' : 'arraybuffer' };
 
     applyAxiosProxyConfig(options, url);
+    applySSRFSafeAgentIfDirect(options, url, allowedAddresses);
 
     try {
       return await axios.post(url, data, options);
@@ -305,10 +308,16 @@ class TTSService {
       res.setHeader('Content-Type', 'audio/mpeg');
       const provider = this.getProvider(appConfig);
       const ttsSchema = appConfig?.speech?.tts?.[provider];
+      const allowedAddresses = appConfig?.speech?.tts?.allowedAddresses;
       const voice = await this.getVoice(ttsSchema, requestVoice);
 
       if (input.length < 4096) {
-        const response = await this.ttsRequest(provider, ttsSchema, { input, voice });
+        const response = await this.ttsRequest(
+          provider,
+          ttsSchema,
+          { input, voice },
+          allowedAddresses,
+        );
         response.data.pipe(res);
         return;
       }
@@ -317,11 +326,16 @@ class TTSService {
 
       for (const chunk of textChunks) {
         try {
-          const response = await this.ttsRequest(provider, ttsSchema, {
-            voice,
-            input: chunk.text,
-            stream: true,
-          });
+          const response = await this.ttsRequest(
+            provider,
+            ttsSchema,
+            {
+              voice,
+              input: chunk.text,
+              stream: true,
+            },
+            allowedAddresses,
+          );
 
           logger.debug(`[textToSpeech] user: ${req?.user?.id} | writing audio stream`);
           await new Promise((resolve) => {
@@ -373,6 +387,7 @@ class TTSService {
       }));
     const provider = this.getProvider(appConfig);
     const ttsSchema = appConfig?.speech?.tts?.[provider];
+    const allowedAddresses = appConfig?.speech?.tts?.allowedAddresses;
     const voice = await this.getVoice(ttsSchema, req.body.voice);
 
     let shouldContinue = true;
@@ -399,11 +414,16 @@ class TTSService {
 
         for (const update of updates) {
           try {
-            const response = await this.ttsRequest(provider, ttsSchema, {
-              voice,
-              input: update.text,
-              stream: true,
-            });
+            const response = await this.ttsRequest(
+              provider,
+              ttsSchema,
+              {
+                voice,
+                input: update.text,
+                stream: true,
+              },
+              allowedAddresses,
+            );
 
             if (!shouldContinue) {
               break;

api/server/services/Files/Audio/speechSSRF.spec.js

@@ -0,0 +1,91 @@
+jest.mock('axios');
+jest.mock('@librechat/data-schemas', () => ({
+  logger: { warn: jest.fn(), error: jest.fn(), debug: jest.fn() },
+}));
+jest.mock('~/server/services/Config', () => ({ getAppConfig: jest.fn() }));
+jest.mock('./streamAudio', () => ({
+  getRandomVoiceId: jest.fn(),
+  createChunkProcessor: jest.fn(),
+  splitTextIntoChunks: jest.fn(),
+}));
+
+const axios = require('axios');
+const { STTService } = require('./STTService');
+const { textToSpeech } = require('./TTSService');
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  axios.post.mockReset();
+});
+
+describe('STT sttRequest SSRF guard (real agent)', () => {
+  const audioFile = { originalname: 'a.wav', mimetype: 'audio/wav', size: 1 };
+  const audioBuffer = Buffer.from('audio');
+  const provider = { url: 'http://10.0.0.5:8080', apiKey: 'sk', model: 'whisper-1' };
+
+  it('blocks a private-IP provider url with ESSRF before any request goes out', async () => {
+    const service = new STTService();
+    await expect(
+      service.sttRequest('openai', provider, { audioBuffer, audioFile, language: '' }),
+    ).rejects.toMatchObject({ code: 'ESSRF' });
+    expect(axios.post).not.toHaveBeenCalled();
+  });
+
+  it('exempts a host:port in the section allowedAddresses and sets maxRedirects 0 with agents', async () => {
+    axios.post.mockResolvedValue({ status: 200, data: { text: 'ok' } });
+    const service = new STTService();
+
+    await service.sttRequest('openai', provider, { audioBuffer, audioFile, language: '' }, [
+      '10.0.0.5:8080',
+    ]);
+
+    const options = axios.post.mock.calls[0][2];
+    expect(options.maxRedirects).toBe(0);
+    expect(options.httpAgent).toBeDefined();
+    expect(options.httpsAgent).toBeDefined();
+  });
+});
+
+describe('TTS textToSpeech SSRF guard (real agent)', () => {
+  function buildReqRes(allowedAddresses) {
+    const req = {
+      body: { input: 'hi', voice: 'v1' },
+      user: { id: 'u1' },
+      config: {
+        speech: {
+          tts: {
+            ...(allowedAddresses ? { allowedAddresses } : {}),
+            localai: { url: 'http://10.0.0.5:8080', apiKey: 'sk', voices: ['v1'] },
+          },
+        },
+      },
+    };
+    const res = {
+      setHeader: jest.fn(),
+      headersSent: false,
+      status: jest.fn(() => ({ end: jest.fn(), send: jest.fn() })),
+      end: jest.fn(),
+    };
+    return { req, res };
+  }
+
+  it('blocks a private-IP provider url and never issues the outbound request', async () => {
+    const { req, res } = buildReqRes();
+
+    await textToSpeech(req, res);
+
+    expect(axios.post).not.toHaveBeenCalled();
+  });
+
+  it('exempts a host:port in the section allowedAddresses and sets maxRedirects 0 with agents', async () => {
+    axios.post.mockResolvedValue({ status: 200, data: { pipe: jest.fn(), on: jest.fn() } });
+    const { req, res } = buildReqRes(['10.0.0.5:8080']);
+
+    await textToSpeech(req, res);
+
+    const options = axios.post.mock.calls[0][2];
+    expect(options.maxRedirects).toBe(0);
+    expect(options.httpAgent).toBeDefined();
+    expect(options.httpsAgent).toBeDefined();
+  });
+});