RiSearch show.pl Server-Side Request Forgery and Local File Read

A remote attacker can make requests through the affected server to attacker-selected HTTP or FTP destinations, potentially bypassing network segmentation or access controls and reaching resources not directly accessible to the attacker. The attacker can also read local files that are accessible under the CGI process's privileges, resulting in information disclosure.

As an interim measure, disable or restrict access to the show.pl CGI script if it is not strictly required. Apply server-side input validation to the url parameter, permitting only expected formats and explicitly blocking file and other unnecessary schemes. Constrain outbound connectivity from the web server to only required destinations and protocols, and limit the web server process's filesystem permissions to reduce the impact of arbitrary file retrieval.

Upgrade RiSearch and RiSearch Pro to a version in which show.pl no longer dereferences untrusted URLs without strict validation. The vulnerable script should be modified to reject user-supplied absolute URLs and disallow dangerous URI schemes, especially file and other nonessential protocols. If remote retrieval is required for functionality, enforce a strict allowlist of permitted schemes, hosts, and destinations, and ensure local file access cannot be triggered through URL handling.