A critical Server-Side Request Forgery vulnerability in Tencent WeKnora 0.1.0 allows for unauthenticated remote exploitation, posing a significant risk to internal network resources.

The application is susceptible to Server-Side Request Forgery (CWE-918) via the testEmbeddingModel function located in the /api/v1/initialization/embedding/test endpoint. An unauthenticated attacker can manipulate the baseUrl parameter to force the server to make unauthorized requests to internal or external network resources.

Successful exploitation allows an attacker to bypass firewalls and interact with internal services that are not exposed to the public internet. With a CVSS score of 7.3, this flaw presents a high risk, as it can lead to information disclosure or the exploitation of other internal services, potentially resulting in unauthorized data access or service disruption.

Immediate Action: As the vendor states the issue does not exist in the latest releases, administrators must verify their current deployment version and upgrade to the most recent version of WeKnora immediately.

Proactive Monitoring: Security teams should monitor network traffic for unusual outbound requests originating from the application server, specifically looking for connections to internal IP addresses or sensitive infrastructure.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block requests containing suspicious URL patterns or unexpected domains in the baseUrl parameter.

Public Exploit Available: Yes, a published proof-of-concept exists and is documented in the referenced GitHub issue.

Given the availability of a public proof-of-concept and the potential for unauthorized internal network access, this vulnerability requires immediate attention. Organizations currently running version 0.1.0 must prioritize migrating to the latest stable release to eliminate the risk of exploitation.