An incomplete SSRF mitigation in Wallos allows authenticated users to perform unauthorized requests against internal infrastructure, posing a significant security risk.

This vulnerability is a Server-Side Request Forgery (CWE-918) flaw where the validation logic for webhook URLs is missing from save endpoints. An authenticated user can supply an internal or private IP address, which the application subsequently requests during background cron job execution.

The ability to perform SSRF attacks allows an attacker to bypass network perimeters, potentially accessing sensitive internal services or metadata endpoints that are not exposed to the public internet. With a CVSS score of 7.7, this vulnerability is considered High severity because it facilitates lateral movement and reconnaissance within the internal network, which could lead to further compromise of backend systems and data.

Immediate Action: Update the Wallos installation to version 4.7.0 or later to ensure the validation logic is correctly applied to all notification endpoints.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the application server, particularly those targeting internal IP ranges or sensitive ports.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal RFC1918 address spaces and restrict the application's ability to communicate with sensitive internal infrastructure.

Public Exploit Available: Unknown.

Given the High severity of this SSRF vulnerability and the existence of proof-of-concept evidence, administrators must prioritize upgrading to version 4.7.0 immediately. Failure to patch allows authenticated users to potentially pivot into internal network segments, rendering perimeter defenses ineffective. Ensure that all deployment environments are updated to neutralize this risk promptly.