An unauthenticated Server-Side Request Forgery vulnerability in the Meeting Room Booking System allows attackers to abuse the application to probe internal network resources.

This is an SSRF vulnerability (CWE-918) which allows an attacker to force the server to make requests to unintended locations. Notably, this vulnerability is exploitable by an unauthenticated attacker (PR:N).

By leveraging the server as a proxy, an attacker can bypass firewalls to scan internal network segments, access sensitive internal APIs, or interact with cloud metadata services. With a CVSS score of 8.7, this vulnerability represents a severe threat to network segmentation and internal defense-in-depth strategies, potentially leading to further lateral movement within the network.

Immediate Action: Upgrade to MRBS version 1.12.2 or higher to resolve the SSRF vulnerability.

Proactive Monitoring: Monitor server egress traffic for unusual outbound connections, especially those directed toward internal IP addresses or sensitive cloud infrastructure endpoints.

Compensating Controls: Restrict the application server's network access to only necessary external resources via firewall egress rules to prevent unauthorized scanning of the internal network.

Public Exploit Available: No confirmed public exploit available.

The ability for an unauthenticated attacker to perform SSRF is a critical security failure. Organizations deploying the Meeting Room Booking System should prioritize patching this software immediately to close the potential vector for internal network reconnaissance and lateral movement.