An authenticated Server-Side Request Forgery vulnerability in the Wallos subscription tracker allows remote attackers to bypass security filters and access sensitive internal cloud metadata.

The vulnerability exists in the getLogoFromUrl function, where the application fails to re-validate destination IP addresses during HTTP redirects. An authenticated attacker can leverage this flaw to redirect requests to internal or reserved IP ranges, effectively bypassing intended access controls.

Successful exploitation of this vulnerability permits unauthorized access to internal network resources and cloud instance metadata. Given the CVSS score of 7.7, this is a High severity issue that could lead to the exposure of sensitive configuration data, internal service credentials, or environmental details, significantly increasing the risk of lateral movement within the network.

Immediate Action: Update Wallos to version 4.6.1 or later immediately to incorporate the necessary redirect validation logic.

Proactive Monitoring: Review web server and application logs for unusual outbound requests originating from the Wallos instance, particularly those targeting internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).

Compensating Controls: Implement egress filtering on the host running Wallos to restrict outbound network traffic to only required external domains, effectively preventing the application from reaching internal network segments.

Public Exploit Available: Unknown

The presence of this Server-Side Request Forgery vulnerability poses a significant risk to internal network security. Administrators must prioritize updating to Wallos version 4.6.1 to resolve the flaw. Failure to patch allows authenticated users to potentially exfiltrate sensitive metadata, making immediate remediation essential for maintaining the integrity and security of the hosting environment.