A Server-Side Request Forgery vulnerability in Trueleaf ApiFlow 0.9.7 exposes internal network resources to unauthorized remote access.

This flaw exists within the validateUrlSecurity function in the file packages/server/src/service/proxy/http_proxy.service.ts, which fails to properly sanitize user-provided input. The vulnerability is remotely exploitable by unauthenticated attackers to perform server-side request forgery.

The vulnerability carries a CVSS score of 7.3, indicating a high level of risk for affected environments. Successful exploitation allows an attacker to interact with internal services that are otherwise protected by a firewall, potentially leading to unauthorized data exposure, internal scanning, or the compromise of sensitive backend infrastructure.

Immediate Action: As no official patch is currently identified, administrators should restrict access to the ApiFlow service to trusted networks only and implement strict egress filtering to prevent unauthorized outbound connections.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the ApiFlow service, specifically looking for attempts to access internal IP addresses or private loopback interfaces.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway with strict URL validation and allow-listing policies to block malformed requests targeting the vulnerable proxy endpoint.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the provided researcher technical write-up.

Given the availability of a public proof-of-concept and the nature of the SSRF vulnerability, organizations using Trueleaf ApiFlow must treat this as a high-priority risk. Immediately implement network-level egress filtering and monitor traffic patterns closely until an official vendor patch is released and applied.