trueleaf ApiFlow Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in trueleaf ApiFlow version 0.9.7. The issue arises in the URL Validation Handler component, specifically within the validateUrlSecurity function of the http_proxy.service.ts file. This vulnerability allows remote attackers to bypass URL validation and make arbitrary requests to internal network resources. The exploitation is possible without authentication, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can manipulate the server to make requests on their behalf. This could be used to access internal services and resources that are not normally exposed to the outside network.