A high severity Server-Side Request Forgery vulnerability in the css_parser Ruby library may allow unauthenticated attackers to perform unauthorized network requests.

This is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). It allows an unauthenticated attacker to manipulate the parser to make unauthorized requests to internal or external resources.

The CVSS score of 8.9 highlights the high severity of this flaw. SSRF vulnerabilities can lead to sensitive data exposure, scanning of internal network infrastructure, and potential interaction with internal services that are not intended to be exposed to the internet. This could result in severe security breaches if the parser is used in an environment with access to internal APIs or metadata services.

Immediate Action: Update the css_parser gem to version 3.0.0 or higher.

Proactive Monitoring: Monitor outbound network traffic from the application server for unusual requests to internal IP ranges or sensitive ports.

Compensating Controls: Use network segmentation and egress filtering to restrict the application server from making unnecessary requests to internal network segments.

Public Exploit Available: No (exploit_available: false)

Given the high impact of SSRF, upgrading css_parser is essential to protect the integrity of internal network resources. If an immediate update is not feasible, restrict the server's network access to prevent unauthorized outbound communication.