A vulnerability in Kovah LinkAce allows authenticated users to perform unauthorized server-side requests to internal resources, posing a significant risk to internal network security.

The application fails to properly restrict server-side requests to internal hostnames, despite blocking direct requests to private IP literals. This vulnerability allows an authenticated user to bypass network segmentation and interact with services reachable by the LinkAce server.

The ability to perform SSRF attacks allows an attacker to map internal network topology and interact with services that are not exposed to the public internet. With a CVSS score of 8.5, this high-severity flaw could lead to the unauthorized retrieval of sensitive internal data or interaction with administrative interfaces, potentially resulting in full system compromise if those internal services are vulnerable.

Immediate Action: Upgrade your LinkAce instance to version 2.5.3 or later to apply the necessary hostname validation logic.

Proactive Monitoring: Review application logs for unusual outbound requests originating from the server to internal network segments or non-standard ports.

Compensating Controls: Ensure the LinkAce server resides in a restricted network zone with strict egress filtering to prevent it from reaching internal management interfaces or sensitive infrastructure services.

Public Exploit Available: Unknown.

Given the potential for unauthorized access to internal network resources, organizations should prioritize upgrading to version 2.5.3 immediately. Failure to patch this vulnerability leaves the internal network perimeter exposed to lateral movement by any authenticated user of the LinkAce platform.