A critical SSRF vulnerability in FlareSolverr versions prior to 3.4.7 allows unauthenticated attackers to bypass network perimeters and access sensitive internal services.

The /v1 API endpoint fails to implement sufficient input validation or allowlisting for requested URLs. This permits a remote, unauthenticated attacker to force the server to issue arbitrary HTTP requests to internal network resources, such as cloud metadata services or private API endpoints.

Successful exploitation of this SSRF vulnerability poses a severe risk to organizational infrastructure. An attacker can use the FlareSolverr instance as a proxy to reach internal assets that are not otherwise exposed to the internet, potentially leading to unauthorized data exfiltration or the compromise of internal credentials. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent lateral movement within the environment.

Immediate Action: Upgrade all instances of FlareSolverr to version 3.4.7 or later to implement necessary URL validation.

Proactive Monitoring: Inspect network logs for unusual egress traffic originating from the FlareSolverr server, particularly requests targeting internal IP ranges or cloud management endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) or egress filtering rules to restrict the server from initiating connections to non-essential internal network segments.

Public Exploit Available: Yes, a public proof-of-concept exists.

Given the availability of proof-of-concept code and the high potential for internal network exposure, organizations should prioritize the update to version 3.4.7 immediately. Failure to remediate could allow attackers to bypass security boundaries and compromise internal systems that are otherwise protected by the network perimeter.