Fortisoar Paas EUVD-2025-209451

While the CVSS score of 4.3 is below the typical critical threshold, multiple factors warrant careful consideration. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates network accessibility with low attack complexity, requiring only low-privilege authentication-a realistic threat in multi-user SOAR environments where analysts, contractors, or compromised internal accounts are common. The vulnerability is bounded to confidentiality impact (service discovery) without integrity or availability compromise, limiting immediate operational risk; however, service discovery often serves as reconnaissance for secondary attacks targeting identified internal services. The absence of a public exploit (POC negative) and lack of KEV status confirmation reduces real-world exploitation probability at present, but the low barrier to entry (network + low privilege required) suggests this vulnerability may be exploited opportunistically by insiders or compromised accounts rather than external threat actors. SSRF vulnerabilities in security infrastructure are typically assigned elevated priority by defenders due to their potential to bridge network trust boundaries.

An authenticated analyst or compromised low-privilege user account on FortiSOAR crafts a malicious request targeting an internal service URL (e.g., http://localhost:9200 for Elasticsearch, http://127.0.0.1:5432 for PostgreSQL). The vulnerable request handler fails to validate and block this SSRF attempt, instead forwarding the request and returning response metadata or service signatures that reveal whether the internal service is running and accessible. The attacker uses this intelligence to map the internal service architecture and identify targets for secondary attacks such as credential harvesting or data exfiltration from exposed management endpoints.