A critical Server-Side Request Forgery vulnerability in mingSoft MCMS versions 5.0 through 5.5.0 allows attackers to perform unauthorized requests from the application server, posing a significant risk of internal network compromise.

The vulnerability exists in the catchImage function within net/mingsoft/cms/action/BaseAction.java, where user-supplied URLs in the source[] parameter are fetched by the server without adequate validation. This allows an unauthenticated or low-privileged attacker (depending on deployment configuration) to trigger outbound requests from the application server.

Successful exploitation of this vulnerability can lead to unauthorized access to internal network resources, cloud metadata services, and local services that are not exposed to the public internet. By abusing the server as a proxy, an attacker can bypass perimeter security controls, potentially leading to sensitive data exposure or further lateral movement within the network. With a CVSS score of 7.3, this flaw represents a significant risk to the confidentiality and integrity of the internal infrastructure.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the editor endpoint or disable the remote image capture feature if it is not business-critical.

Proactive Monitoring: Review web server and application logs for suspicious action=catchimage requests, particularly those containing non-standard URLs or internal IP addresses (e.g., 127.0.0.1, 169.254.169.254).

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to internal network segments and sensitive metadata endpoints. A Web Application Firewall (WAF) can be configured to block requests containing malicious source[] parameters.

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up referenced in the GitHub issue tracker (github.com/wing3e/public_exp/issues/3).

Given the availability of a public proof-of-concept and the potential for internal network reconnaissance, this vulnerability should be treated with high priority. Organizations using affected versions of mingSoft MCMS must implement egress filtering and restrict access to the vulnerable editor endpoint immediately. Security teams should monitor for vendor updates and apply them as soon as they become available to permanently remediate the underlying flaw.