The Wyoming server-side request forgery vulnerability allows unauthenticated remote attackers to force outbound network connections, posing a significant risk to internal network security.

This vulnerability is a Server-Side Request Forgery (CWE-918) occurring in the HTTP API. Unauthenticated attackers can supply a malicious uri parameter to endpoints like /api/info, /api/speech-to-text, or /api/text-to-speech to redirect server-initiated requests to arbitrary internal or external hosts using tcp or unix protocols.

The ability for an unauthenticated attacker to perform SSRF allows them to interact with internal services that are not exposed to the public internet. This can lead to unauthorized information disclosure, the scanning of internal network infrastructure, or the exploitation of other internal services, justifying the high CVSS score of 8.3.

Immediate Action: Upgrade to version 1.10.2 or later, which contains the necessary fix for the URI handling logic.

Proactive Monitoring: Review web access logs for requests containing suspicious uri parameters or unconventional protocols like tcp and unix.

Compensating Controls: Implement strict egress filtering on the server to prevent unauthorized outbound connections to internal network segments or unauthorized external destinations.

Public Exploit Available: No

Given the high severity and the unauthenticated nature of this vulnerability, administrators should prioritize patching the affected software immediately. Failure to update permits attackers to leverage the server as a proxy for internal network reconnaissance and potential lateral movement.