An unauthenticated SSRF vulnerability in the FOG cloning and imaging suite allows remote attackers to access sensitive internal network resources or local system files.

The vulnerability is a Server-Side Request Forgery (SSRF) flaw residing in the getversion.php script, which fails to validate user-controlled input in the url parameter. This flaw can be triggered by an unauthenticated attacker when the request includes the newService=1 parameter.

The ability for an unauthenticated attacker to perform SSRF poses a significant risk to internal network security. By leveraging this vulnerability, an attacker can bypass perimeter defenses to scan internal networks, interact with non-public services, or read sensitive local files, which could lead to further compromise of the imaging server and the systems it manages. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent unauthorized data access and potential lateral movement.

Immediate Action: As no fixed release version is currently available, administrators should restrict access to the FOG web interface, specifically the getversion.php endpoint, using network-level controls or a Web Application Firewall.

Proactive Monitoring: Monitor web access logs for unusual requests to getversion.php containing the newService=1 parameter and unexpected URL values in the query string.

Compensating Controls: Deploy WAF rules to sanitize or block input to the url parameter in getversion.php and ensure the FOG server is isolated within a restricted VLAN to minimize the potential impact of SSRF.

Public Exploit Available: Unknown.

Given the lack of a vendor-supplied patch, organizations relying on FOG must prioritize network-based mitigations to block access to the vulnerable endpoint. Administrators should monitor official project security advisories closely for the release of a permanent fix and apply it as soon as it becomes available to ensure the integrity of the imaging environment.