Halo Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Halo versions through 2.20.17. The issue arises in the endpoint responsible for uploading attachments from a URL, allowing attackers to manipulate server-side requests.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests on its behalf. This could potentially be used to access internal services or resources that are not normally exposed.