A Server-Side Request Forgery vulnerability in the Eclipse BaSyx Java Server SDK affects versions prior to 2.0.0-milestone-10 and introduces severe network pivot risks.

This is a Server-Side Request Forgery (CWE-918) flaw located in the Operation Delegation feature, triggered when handling unauthenticated requests without validating the destination URI of delegated requests.

A successful exploit allows an unauthenticated remote attacker to bypass standard network segmentation, potentially gaining unauthorized access to isolated internal IT and OT infrastructure or sensitive Cloud Metadata services. Given the high CVSS score of 8.6, this exposure can lead to severe data compromise, lateral movement, and extensive internal infrastructure mapping by malicious actors.

Immediate Action: Upgrade the Eclipse BaSyx Java Server SDK to version 2.0.0-milestone-10 or later as soon as the official vendor update is applied.

Proactive Monitoring: Monitor network edge firewalls and server logs for anomalous outbound HTTP POST requests originating from the BaSyx server toward internal network segments or cloud metadata endpoints.

Compensating Controls: Implement strict egress filtering and network segmentation rules on the host running the SDK to block internal IP ranges and restrict external traffic to only explicitly approved destinations.

Public Exploit Available: False

This vulnerability presents a high-risk exposure due to its potential to facilitate lateral movement across internal network boundaries. Administrators must prioritize updating the software to the patched release and enforcing stringent egress filtering to mitigate potential Server-Side Request Forgery attacks.