A critical server-side request forgery vulnerability in MediaFlow Proxy allows unauthenticated attackers to perform unauthorized requests against internal infrastructure and cloud metadata services.

The application fails to properly validate the destination URL provided via the d query parameter in the /proxy routes. This allows an unauthenticated remote attacker to force the server to initiate requests to arbitrary internal URLs, including loopback addresses and sensitive cloud metadata endpoints.

Successful exploitation of this vulnerability can lead to significant security breaches, including the theft of cloud instance credentials, unauthorized access to internal services, and potential reconnaissance of private network segments. Given the CVSS score of 8.2, this represents a high-severity risk that could facilitate full system compromise or lateral movement within the organization's network environment.

Immediate Action: Upgrade to the latest version of MediaFlow Proxy beyond 2.4.9 to incorporate the necessary destination validation logic.

Proactive Monitoring: Review web access logs for requests to the /proxy endpoint containing suspicious d parameters, specifically looking for internal IP addresses, localhost, or cloud metadata IP addresses (e.g., 169.254.169.254).

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or sanitize requests to the /proxy endpoint that contain internal network patterns or suspicious URL schemes in the d query parameter.

Public Exploit Available: No — exploit_available (unknown)

This vulnerability presents a substantial risk to internal network security and cloud infrastructure integrity. Organizations utilizing MediaFlow Proxy should prioritize updating their software to the latest patched version immediately. If an update cannot be performed today, implement strict input validation at the gateway level to prevent the proxy from reaching internal or restricted network ranges.