NucleoidAI Nucleoid is vulnerable to a server-side request forgery flaw that allows remote, unauthenticated attackers to force the application to perform unauthorized outbound requests.

The vulnerability exists in the extension.apply function within the src/cluster.ts file. Unauthenticated attackers can manipulate arguments for host, IP, port, path, and headers to trigger server-side request forgery.

Successful exploitation allows an attacker to interact with internal network resources or external services that the server can access, potentially bypassing perimeter security controls. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to internal infrastructure confidentiality and integrity, as it facilitates unauthorized scanning or data exfiltration from the server environment.

Immediate Action: Review the NucleoidAI vendor advisory for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Monitor outbound network traffic from the Nucleoid server for unusual destination IP addresses or unexpected HTTP request patterns that deviate from standard application behavior.

Compensating Controls: Implement strict egress filtering on the server hosting the application to prevent unauthorized outbound connections to internal or sensitive external networks.

Public Exploit Available: Unknown.

Given the ability for remote, unauthenticated attackers to abuse this functionality, immediate attention is required. Organizations should prioritize updating the Nucleoid component as soon as the vendor releases a fix and verify that egress traffic is restricted to known, trusted destinations to mitigate the potential for unauthorized network reconnaissance.