A critical SSRF vulnerability in Okulistik allows attackers to use the server as a proxy to attack internal infrastructure or bypass network security controls.

The application allows users to provide URLs that the server then fetches without proper validation. This SSRF flaw enables an attacker to force the server to send requests to internal metadata services, private network IPs, or other restricted endpoints.

With a CVSS score of 9.8, this SSRF is particularly dangerous as it can be used to scan internal networks, access cloud environment metadata (like AWS/Azure credentials), or exploit other internal services that are not exposed to the internet. This can lead to a secondary compromise of the entire cloud or local infrastructure.

Immediate Action: Update the Okulistik software to the latest version to ensure that all user-supplied URLs are validated against a strict allow-list.

Proactive Monitoring: Review outbound network logs from the Okulistik server for requests to internal IP ranges (e.g., 10.x.x.x, 192.168.x.x) or cloud metadata services (169.254.169.254).

Compensating Controls: Implement egress filtering at the network level to prevent the web server from initiating connections to sensitive internal ports or unauthorized external domains.

Public Exploit Available: false

The high CVSS score suggests this SSRF could lead to full system compromise. Administrators must apply updates immediately and ensure the server's network environment is hardened to prevent the server from accessing its own internal management interfaces.