An authenticated administrator can exploit a Server-Side Request Forgery vulnerability in Wallos version 4.9.5 and earlier to access cloud metadata or pivot into internal networks.

The application fails to perform input validation on OIDC token and user info URLs, allowing an administrator to inject malicious targets into the curl_init function. This bypasses the protections applied to other URL fields and enables arbitrary requests from the host server.

Successful exploitation of this flaw could allow an attacker with administrative access to reach internal-only services or extract sensitive cloud environment metadata. With a CVSS score of 8.5, this high-severity vulnerability poses a significant risk to the confidentiality and integrity of the hosting infrastructure.

Immediate Action: Update Wallos to version 4.9.6 or later immediately to incorporate the necessary input validation for OIDC configuration URLs.

Proactive Monitoring: Review application logs for unusual outbound requests initiated by the Wallos service and monitor for access attempts targeting internal IP ranges.

Compensating Controls: Ensure the Wallos instance is deployed with strict network egress filtering to prevent the application from making unauthorized requests to internal network segments or metadata services.

Public Exploit Available: No

The risk presented by this SSRF vulnerability is substantial, particularly for cloud-hosted deployments where metadata services are accessible. Administrators should prioritize updating the Wallos installation to version 4.9.6 to remediate this flaw and prevent potential internal network pivoting.