Authenticated full-read SSRF in CloudTAK basemap import endpoint

Successful exploitation allows an authenticated attacker to use the CloudTAK server as a proxy to reach resources that are not directly accessible from the attacker’s network location. This can expose internal-only HTTP services, loopback-hosted applications, private network endpoints, link-local services, and cloud metadata interfaces. In cloud environments, the vulnerability may enable retrieval of instance metadata and associated credentials. It also supports internal service enumeration and access to sensitive administrative or infrastructure endpoints reachable from the server.

Until a fix is deployed, disable or tightly restrict user-controlled basemap URL import functionality. Enforce egress filtering from the CloudTAK API server to prevent access to internal address ranges and metadata services. Apply network-layer controls to block server access to loopback, private, link-local, and cloud metadata destinations. Monitor for suspicious authenticated requests that supply external URLs to the basemap import workflow and review logs for signs of internal resource probing or metadata access attempts.

Upgrade to a vendor-fixed release once available. In the vulnerable code path, replace unrestricted URL fetching with a hardened fetch routine that resolves and validates destination addresses before connection and re-validates each redirect hop. Deny requests to internal and non-routable address spaces, including loopback, private IPv4 ranges, carrier-grade NAT space, link-local ranges, IPv6 unique local addresses, IPv6 link-local addresses, IPv4-mapped IPv6 addresses, and NAT64-related destinations where applicable. Apply the same validation model consistently to the basemap import functionality and any related server-side URL retrieval features, including ESRI or metadata fetch paths.