A critical, unauthenticated server-side request forgery vulnerability in projeto-siga siga allows remote attackers to interact with internal network services and sensitive local resources.

The application fails to properly validate user-supplied input within the HTML-to-PDF conversion function, specifically targeting the html parameter in the ExUtilController.java file. This flaw permits unauthenticated remote attackers to force the server to perform arbitrary HTTP requests against internal, loopback, or external network targets.

Successful exploitation of this vulnerability enables attackers to bypass network perimeter defenses by leveraging the server as a proxy to probe internal infrastructure. This can lead to the disclosure of sensitive configuration data, unauthorized interaction with internal APIs, or service disruption via resource exhaustion. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to the confidentiality and integrity of internal network segments.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /sigaex/public/app/util/html-pdf endpoint at the network or web application firewall level.

Proactive Monitoring: Review web server and application logs for suspicious POST requests to the HTML-to-PDF endpoint, particularly those containing external URLs or unusual internal IP addresses in the html argument.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect traffic directed toward the vulnerable endpoint, ensuring that requests containing suspicious URL patterns or internal network headers are dropped.

Public Exploit Available: Yes, a published proof-of-concept exists in the official project issue tracker.

Given the availability of a public proof-of-concept and the lack of a vendor-supplied patch, organizations must prioritize the implementation of compensating controls to isolate the vulnerable endpoint. Blocking public access to this function is the most effective way to prevent exploitation until the vendor releases a secure update.