An unauthenticated server-side request forgery vulnerability in Webstudio versions up to 0.296.0 allows remote attackers to access sensitive internal infrastructure and cloud metadata.

The application fails to properly validate inputs in the /cgi/image, /cgi/video, and /cgi/asset proxy routes when the RESIZE_ORIGIN environment variable is unset. This allows an unauthenticated attacker to supply arbitrary URLs to these endpoints, resulting in server-side request forgery.

Successful exploitation of this vulnerability permits unauthorized access to internal services and cloud instance metadata, which often contains sensitive credentials or configuration data. Given the CVSS score of 8.6, this flaw poses a high risk to organizational confidentiality and infrastructure integrity. Attackers can leverage this access to perform internal network reconnaissance, potentially leading to further compromise of the internal environment.

Immediate Action: Ensure the RESIZE_ORIGIN environment variable is explicitly set and configured to a trusted origin to prevent the vulnerable fallback behavior.

Proactive Monitoring: Review web server and application access logs for anomalous requests to the /cgi/ URI paths, particularly those containing external URLs or unusual query parameters.

Compensating Controls: Implement strict egress filtering on the application server to prevent connections to sensitive internal IP ranges, such as the cloud metadata service (169.254.169.254).

Public Exploit Available: Unknown

The severity of this vulnerability necessitates immediate attention to your environment configuration. Administrators should verify their Webstudio deployment settings and ensure that the RESIZE_ORIGIN variable is correctly defined to mitigate this exposure. Until an official patch is released, restricting network access to the application server and monitoring logs are critical steps to protect against potential exploitation.