A critical Server-Side Request Forgery vulnerability in Prebid Server Java allows unauthenticated remote attackers to perform unauthorized requests to internal network services.

The application fails to properly validate bid-request parameters before interpolating them into outbound request URLs. This flaw allows an unauthenticated attacker to manipulate the server into making arbitrary HTTP requests to internal metadata endpoints or sensitive network services.

This vulnerability carries a CVSS score of 10.0, reflecting its potential for complete system compromise. Successful exploitation could allow an attacker to bypass perimeter security, access internal-only management interfaces, or exfiltrate sensitive environment metadata, leading to significant data breaches and unauthorized control over the server infrastructure.

Immediate Action: Upgrade prebid-server-java to version 3.43.0 or later to ensure proper URL validation using HttpUtil.

Proactive Monitoring: Review web access and application logs for unusual outbound request patterns or suspicious parameter inputs targeting internal IP addresses.

Compensating Controls: Deploy a strict egress filtering policy at the network level to restrict the server from accessing internal network segments or unauthorized external domains.

Public Exploit Available: No

Given the critical severity and the potential for full unauthorized access to internal resources, organizations should prioritize patching this vulnerability immediately. Upgrading to version 3.43.0 is the only reliable way to remediate the underlying logic flaw that enables these SSRF attacks.