An authenticated server-side request forgery vulnerability in Automatisch allows low-privileged users to force the server to perform unauthorized network requests, posing a significant risk of data exfiltration.

The application is susceptible to a server-side request forgery (SSRF) flaw within the HTTP Request app's Custom Request action. An authenticated user with "manage Flow" permissions can exploit this to force the server to interact with arbitrary external or internal resources.

Successful exploitation allows an attacker to bypass network perimeter controls and access internal services that are not exposed to the public internet. With a CVSS score of 7.7, this high-severity flaw could lead to the unauthorized disclosure of sensitive internal data or the mapping of internal network infrastructure.

Immediate Action: Review the Automatisch repository for available patches or updates beyond commit 41f3c56. If a formal release is unavailable, restrict the "manage Flow" permission to only the most trusted users.

Proactive Monitoring: Monitor server egress logs for requests originating from the application to unexpected internal IP addresses or sensitive endpoints.

Compensating Controls: Implement an egress filtering policy on the host firewall to restrict the application server from initiating connections to unauthorized internal network ranges.

Public Exploit Available: Unknown

Given the potential for unauthorized data access and internal network reconnaissance, administrators should prioritize restricting access to the affected workflow management features. Organizations must apply security updates as soon as they are provided by the vendor to fully mitigate this SSRF risk.