A Server-Side Request Forgery vulnerability in the decolua 9router application allows authenticated users to trigger unauthorized requests to internal or external resources.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring within the v1 web fetch module, which can be leveraged by an authenticated user to force the server to make unintended network requests.

An SSRF vulnerability allows an attacker to bypass firewalls or network access control lists by using the vulnerable server as a proxy to reach internal services that are not exposed to the public internet. This can lead to the exposure of internal metadata services, unauthorized access to internal APIs, or the discovery of private network infrastructure. The CVSS score of 7.7 highlights the potential for significant internal network reconnaissance and subsequent compromise.

Immediate Action: Update the 9router application to version 0.4.72 or later.

Proactive Monitoring: Monitor outgoing network traffic from the server hosting 9router for unusual requests directed toward internal IP ranges or sensitive internal services.

Compensating Controls: Configure the server's network access controls to limit its ability to initiate outbound connections to sensitive internal segments or the public internet.

Public Exploit Available: Unknown

Upgrade to version 0.4.72 immediately to resolve the SSRF flaw. Security teams should also evaluate the network exposure of any server running 9router and implement strict egress filtering to minimize the impact of potential future SSRF-style vulnerabilities.