An unauthenticated Server-Side Request Forgery vulnerability in Wallos allows remote attackers to perform unauthorized requests, posing a significant risk to internal network resources.

This vulnerability is a Server-Side Request Forgery (SSRF) flaw occurring in the endpoints/payments/search.php file. An unauthenticated attacker can manipulate the cURL proxy settings by leveraging the HTTP_PROXY or HTTPS_PROXY environment variables, allowing the application to act as a confused deputy.

The ability for an unauthenticated attacker to force the application to make arbitrary network requests can lead to the exposure of sensitive internal services, bypassing network segmentation and firewalls. With a CVSS score of 8.2, this high-severity flaw could facilitate internal reconnaissance or unauthorized access to backend data, potentially resulting in a significant data breach or service disruption.

Immediate Action: Upgrade Wallos to version 5.0.0 or later, which includes the necessary hardening of the cURL configuration to prevent proxy abuse.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the Wallos host, particularly those directed toward internal IP addresses or sensitive infrastructure.

Compensating Controls: Implement egress filtering on the host firewall to restrict the application from initiating connections to unauthorized internal or external destinations.

Public Exploit Available: No (exploit_available unknown)

Given the high severity of this SSRF vulnerability and the ease of exploitation for unauthenticated actors, administrators must prioritize the update to version 5.0.0. Failure to patch allows potential attackers to leverage the server as a proxy to attack internal assets that are otherwise protected from the public internet.