A critical Server-Side Request Forgery vulnerability in Typecho allows unauthenticated attackers to perform unauthorized requests to internal network services, potentially leading to full system compromise.

The vulnerability exists in the Service::sendPingHandle function within var/Widget/Service.php, where weak token validation allows an unauthenticated attacker to bypass security checks and trigger a two-stage SSRF attack. By manipulating the pingback argument, an attacker can force the server to issue arbitrary POST requests to internal infrastructure, including support for protocols like gopher, dict, and file.

The ability to perform SSRF against internal network resources poses a severe risk to organizational security. An attacker can interact with internal services that are not exposed to the internet, such as Redis, Memcached, or databases, potentially leading to unauthorized data access, remote code execution, or internal network scanning. With a CVSS score of 7.3, this flaw represents a significant threat to the confidentiality and integrity of the internal environment.

Immediate Action: As no official patch is currently available, administrators should immediately disable the Pingback functionality or restrict access to the /action/service?do=ping endpoint via a web application firewall or server configuration.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /action/service endpoint, particularly those originating from unknown or suspicious IP addresses.

Compensating Controls: Implement strict egress filtering on the web server to prevent it from initiating connections to internal network segments or unauthorized external endpoints.

Public Exploit Available: Yes — a detailed technical write-up and proof-of-concept are available via the researcher's blog (wang1rrr.github.io).

Given the availability of a public proof-of-concept and the potential for internal network compromise, this vulnerability should be prioritized for mitigation. Organizations running Typecho must immediately restrict access to the vulnerable endpoint or disable the Pingback feature entirely until a security update is released by the vendor.