An authenticated server-side request forgery vulnerability in Cloudreve allows unauthorized access to internal network services and cloud metadata.

This vulnerability is an SSRF flaw located in the ValidateExternalURL function. An authenticated user with remote-download access can bypass security guards by providing crafted URIs that utilize NAT64, IPv4-compatible, or 6to4 IPv6 transition forms, which the system fails to decode correctly.

Successful exploitation allows an attacker to interact with internal services that are otherwise protected by network boundaries. This can lead to the exfiltration of sensitive internal data, the theft of cloud instance credentials, and unauthorized interaction with private network endpoints, which could facilitate further lateral movement. While the CVSS score of 6.5 reflects a Medium severity, the potential for credential exposure in cloud environments presents a significant risk to organizational security posture.

Immediate Action: Update Cloudreve to version 4.18.0 or later, as this release contains the necessary logic to properly validate and block restricted IP addresses.

Proactive Monitoring: Review application logs for suspicious RemoteDownloadTask activity, specifically looking for attempts to access local or private IP address ranges.

Compensating Controls: Implement strict egress filtering at the network level to prevent the application server from initiating connections to private, loopback, or cloud metadata service addresses.

Public Exploit Available: No (exploit_available: unknown)

Given that this vulnerability allows for the bypass of critical network access controls, organizations should prioritize the update to version 4.18.0. Administrators must ensure that the application environment is configured to restrict outbound traffic to only necessary external endpoints to minimize the impact of potential future SSRF-related vulnerabilities.