SocialEngine versions 7.8.0 and prior are susceptible to an authenticated Server-Side Request Forgery (SSRF) vulnerability that enables attackers to probe internal network infrastructure.

This is a blind Server-Side Request Forgery (SSRF) flaw occurring in the /core/link/preview endpoint. An authenticated attacker can manipulate the uri parameter to force the server to initiate arbitrary HTTP requests to internal network resources or local services.

Successful exploitation of this vulnerability allows an attacker to bypass perimeter security controls and interact with services residing within the internal network that are not exposed to the public internet. This can lead to unauthorized information disclosure, internal service enumeration, and potential lateral movement within the environment. Given the CVSS score of 8.5, this high-severity flaw represents a significant risk to organizational infrastructure integrity.

Immediate Action: Upgrade SocialEngine to version 8.0.0 or later, which contains the necessary security fixes to sanitize the uri parameter.

Proactive Monitoring: Monitor server access logs for anomalous requests to the /core/link/preview endpoint, particularly those containing internal IP addresses or localhost references in the uri parameter.

Compensating Controls: Implement strict egress filtering on the web server to prevent it from initiating connections to sensitive internal network ranges or unauthorized external domains.

Public Exploit Available: Yes — a published proof-of-concept exists, attributed to the research write-up by Egidio Romano at karmainsecurity.com.

This vulnerability presents a clear path for internal network reconnaissance and must be addressed with high priority. Organizations currently running SocialEngine versions 7.8.0 or older should immediately verify their installation and plan for an upgrade to version 8.0.0. Delaying this update leaves internal network assets exposed to unauthorized interrogation by any authenticated user.