An authenticated Server-Side Request Forgery vulnerability in 9router allows attackers to bypass security guards and issue arbitrary requests from the server.

This is a CWE-918 Server-Side Request Forgery vulnerability combined with CWE-184 Incomplete List of Disallowed Inputs. The validation logic for the baseUrl parameter fails to properly block IPv4-mapped IPv6 addresses, allowing an authenticated attacker to reach forbidden destinations.

While the attack requires low privileges, the ability to bypass SSRF protections can be used to scan internal network services that are otherwise unreachable from the public internet. With a CVSS score of 8.5, this vulnerability represents a significant risk to internal network privacy and could be used as a stepping stone for further exploitation of internal microservices.

Immediate Action: Update 9router to the latest available version that includes the patch for the ssrfGuard utility.

Proactive Monitoring: Monitor API usage logs for the /api/provider-nodes/validate endpoint, focusing on requests that contain suspicious IP addresses or internal hostnames.

Compensating Controls: Implement network-level egress restrictions on the application server to prevent it from communicating with internal-only network ranges that do not require external access.

Public Exploit Available: No (exploit_available: false)

Organizations should prioritize updating 9router to mitigate this SSRF risk. Although the vulnerability requires authentication, the potential for internal network reconnaissance makes it a high-priority item for remediation in environments where the application has access to sensitive internal network segments.