Technical impact
A vulnerability exists in Kameleo up to version 5.0.1.26 where the InternalController.TestProxy endpoint accepts a host/port argument that can be manipulated to cause the server to initiate an HTTP request to an arbitrary address. This server‑side request forgery allows an attacker to make the target machine contact internal or external resources, potentially exfiltrating sensitive data or interacting with internal services. The weakness is classified as CWE‑918.
Affected Systems
Affected vendors and products include the Kameleo application, specifically the Proxy Validation component; the vulnerability is present in all releases up to 5.0.1.26 and is fixed in release 5.2.0, which removes the vulnerable route and replaces it with /general/test-proxy.
Risk and Exploitability
The CVSS score of 5.1 indicates a moderate severity, and the attack can be launched remotely by supplying malicious host/port values. While no EPSS score is available, the lack of a KEV listing suggests that public exploitation is not yet confirmed. The risk is that an attacker with network access to the Kameleo server could force outbound connections, making the vulnerability a moderate but actionable threat.
