A Server-Side Request Forgery (SSRF) vulnerability in CoreWorxLab CAAL (up to version 1.6.0) enables unauthenticated attackers to abuse the server to make unauthorized requests.

This vulnerability is identified as CWE-918 (Server-Side Request Forgery). The application fails to properly validate user-controlled input used in requests, allowing an unauthenticated attacker to force the server to interact with internal or external resources.

The CVSS score of 7.3 highlights the severity of this issue, as it allows for unauthenticated access to internal services that are otherwise protected by firewalls. This can lead to the exposure of internal metadata, scanning of the internal network, or the potential compromise of backend services, leading to a significant breach of the internal security perimeter.

Immediate Action: Identify all instances of CoreWorxLab CAAL and apply vendor-supplied updates as soon as they become available. Until an update is applied, restrict the application server's ability to communicate with internal resources via network segmentation.

Proactive Monitoring: Monitor egress traffic from the application server for unexpected requests, especially those targeting internal IP addresses or sensitive internal services.

Compensating Controls: Implement strict egress filtering on the server to prevent it from initiating unauthorized connections to sensitive internal or external endpoints.

Public Exploit Available: No — no confirmed public weaponized exploit exists in the provided data.

SSRF vulnerabilities are critical when they allow attackers to bypass network security controls. Organizations using CoreWorxLab CAAL should immediately review their network architecture to ensure the application is not positioned in a way that allows it to bridge external and internal network segments. Prioritize patching once the vendor releases a fix.