A critical SSRF vulnerability in MetInfo CMS through version 8.1 allows unauthenticated attackers to perform unauthorized network requests, posing a significant risk to internal infrastructure.

The application contains a flaw in its XML parsing logic that permits XXE injection, enabling an unauthenticated attacker to force the server to initiate arbitrary HTTP requests. This vulnerability is accessible via the backend API associated with the path /admin/#/webset/?head_tab_active=0.

Successful exploitation allows an attacker to conduct internal network reconnaissance, perform port scanning, or retrieve sensitive configuration data from the server environment. Given the CVSS score of 7.5, this high-severity vulnerability could lead to unauthorized access to internal resources that are otherwise protected by the network perimeter, potentially exposing internal service credentials or proprietary information.

Immediate Action: Since a specific patch version is currently unknown, administrators should restrict network access to the affected administrative endpoints and disable XML parsing features if they are not strictly required for business operations.

Proactive Monitoring: Monitor server logs for unusual outbound HTTP requests originating from the CMS server to internal network segments or unauthorized external endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to block or inspect incoming XML payloads for malicious entity definitions, which can serve as a temporary virtual patch.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the research write-up by sh4ll0t.

The presence of a functional proof-of-concept elevates the risk of this SSRF vulnerability, making it an attractive target for attackers performing reconnaissance. Organizations using MetInfo CMS should prioritize restricting access to the administrative API and remain vigilant for vendor-provided security updates to address the underlying XML parsing defect.