Prebid Server versions prior to 4.4.0 contain a critical server-side request forgery vulnerability that allows attackers to probe internal networks or access sensitive endpoints.

The issue stems from the improper validation of host and subdomain values during the interpolation of bidder adapter parameters. This allows unauthenticated attackers to manipulate outbound request URLs, resulting in server-side request forgery.

This vulnerability allows attackers to bypass perimeter security by utilizing the server as a proxy to reach internal services that are not exposed to the public internet. With a CVSS score of 10.0, the potential for total system compromise, data exfiltration, or lateral movement within the network is extreme. Organizations should treat this as an urgent priority to prevent unauthorized access to internal infrastructure.

Immediate Action: Update to Prebid Server version 4.4.0 or later to ensure proper validation of request parameters.

Proactive Monitoring: Monitor egress traffic from the Prebid Server for connections to suspicious or internal-only IP addresses and domains.

Compensating Controls: Implement strict egress filtering at the network level to prevent the server from initiating unauthorized connections to sensitive internal segments or restricted external domains.

Public Exploit Available: No (unknown)

The severity of this issue necessitates immediate remediation. Administrators should verify their current version and apply the 4.4.0 update across all production instances to mitigate the risk of server-side request forgery and potential internal network exposure.