XenForo 2.3.8 is vulnerable to server-side request forgery, allowing attackers to enumerate internal services and expose the host server IP address.

This is a server-side request forgery vulnerability involving the RSS feed creation and saving functionality, requiring administrative privileges or specific feed management access.

A successful exploit allows unauthorized internal network reconnaissance, potentially exposing backend infrastructure details and the true IP address of the hosting server. This intelligence gathering can facilitate subsequent targeted attacks against internal network perimeters. The high severity designation is justified by a CVSS score of 7.5, reflecting significant potential for information disclosure.

Immediate Action: Restrict administrative access to trusted personnel and disable the RSS feed creation feature until a vendor patch is released.

Proactive Monitoring: Monitor server access logs for unusual outbound requests originating from the web application server toward internal network segments.

Compensating Controls: Implement strict egress filtering on the web server firewall to prevent unauthorized outbound connections to internal IP ranges and private subnets.

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Security teams must treat this vulnerability with high urgency despite the requirement for administrative capabilities or feed management access. Administrators should apply compensating network controls immediately and monitor vendor advisories closely for the release of an official security patch.