An unauthenticated SSRF vulnerability in QD software allows remote attackers to perform unauthorized requests against internal infrastructure and cloud metadata services.

The vulnerability exists within the Fetcher.build_request function in libs/fetcher.py, which fails to validate user-supplied URL schemes or hostnames when constructing requests. Because the /har/test handler does not require authentication and disables TLS verification, unauthenticated remote attackers can perform unauthorized reconnaissance or data exfiltration against internal network segments.

The ability to perform SSRF against internal resources poses a severe risk, as it allows attackers to bypass perimeter firewalls to interact with sensitive internal services or cloud metadata endpoints. With a CVSS score of 9.1, this critical vulnerability could lead to significant data compromise or unauthorized access to internal systems, potentially resulting in full network exposure.

Immediate Action: Since no specific patch version is currently identified, administrators should immediately restrict access to the /har/test endpoint at the network or web application firewall level.

Proactive Monitoring: Monitor server access logs for suspicious requests targeting the /har/test endpoint, particularly those containing internal IP addresses or cloud metadata service URLs.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating connections to unauthorized internal subnets or sensitive external addresses.

Public Exploit Available: Yes, a proof-of-concept exists as documented in the provided GitHub Gist.

Given the critical severity of this SSRF vulnerability and the public availability of proof-of-concept material, immediate defensive action is required. Organizations should prioritize isolating the affected endpoint to prevent unauthorized internal network access until an official vendor patch is released and applied.