A critical Server-Side Request Forgery vulnerability in 6Storage Rentals enables attackers to bypass network perimeters, posing a significant risk to internal infrastructure.

This SSRF vulnerability allows an unauthenticated attacker to manipulate the application into performing unintended network requests. By submitting crafted requests, the attacker can interact with internal services that are not typically accessible from the external network.

The ability to perform SSRF attacks allows malicious actors to scan internal networks, access sensitive metadata services, or interact with backend databases. With a CVSS score of 9.1, this vulnerability poses a critical risk of data exfiltration and potential compromise of the entire backend infrastructure, leading to significant operational disruption.

Immediate Action: Upgrade 6Storage Rentals to a version beyond 2.19.9 as soon as a security update is released by the vendor.

Proactive Monitoring: Inspect server egress traffic logs for unusual outbound connections to internal IP ranges or sensitive cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the application server and utilize a Web Application Firewall (WAF) to block requests containing suspicious URL parameters or internal hostnames.

Public Exploit Available: Unknown

Given the critical severity and the nature of SSRF vulnerabilities, immediate action is required to harden the network environment. Administrators should verify their current version and apply all available vendor patches, while concurrently restricting outbound network access for the application server to prevent exploitation.