An authenticated server-side request forgery vulnerability in the Huly Platform print service allows attackers to interact with internal network resources and metadata services.

The print service fails to properly validate hostnames when processing URL inputs, leading to a Server-Side Request Forgery (SSRF) flaw (CWE-918). Authenticated workspace members can exploit this by supplying arbitrary URLs to the print endpoint, which the underlying Puppeteer service then retrieves.

The ability to perform SSRF poses a significant risk to internal infrastructure security. An attacker can leverage this vulnerability to bypass perimeter defenses, access sensitive internal metadata services, or perform reconnaissance on internal network hosts that are otherwise unreachable from the public internet. Given the CVSS score of 8.5, this high-severity flaw could lead to unauthorized information disclosure or serve as a pivot point for further lateral movement within the network.

Immediate Action: Upgrade Huly Platform to a version beyond 0.7.426 that includes the enforced hostname allowlist validation.

Proactive Monitoring: Review web server and print service access logs for requests containing suspicious or internal-only URL patterns being passed to the print endpoint.

Compensating Controls: Implement strict egress filtering on the server hosting the print service to prevent it from initiating connections to sensitive internal subnets or cloud metadata services (e.g., 169.254.169.254).

Public Exploit Available: No

This vulnerability represents a critical security oversight in the handling of external requests by the print service. Organizations using Huly Platform should prioritize patching to the latest version immediately to eliminate the risk of internal network exposure. If an immediate update is not feasible, restrict the ability of the print service to access internal network segments through network-level controls.