TerriaJS-Server, a Node.js Express application that powers the TerriaJS geospatial library, implements a proxy endpoint that forwards external HTTP requests after validating the destination domain against a configured allowlist (proxyableDomains). A flaw in that validation logic lets an attacker specify a target domain that is not in the allowlist and still have the request proxied. This bypass allows the attacker to retrieve data from any remote domain, potentially exfiltrating sensitive data or delivering malicious content to users. The vulnerability exists in all releases prior to version 4.0.3 and affects any deployment that enables the proxy feature. The flaw is not mitigated by user authentication; any client that can reach the /proxy endpoint can exercise the bug. While the EPSS score of < 1 % indicates a low current exploitation probability, the danger remains high because the flaw can be triggered without any prerequisites. With a CVSS base score of 8.7 the issue is classified as high severity, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers can exploit it by crafting an HTTP request to /proxy with an arbitrary target domain, resulting in the server forwarding the request. The potential impact includes data leakage, injection of malicious payloads into users, or, if internal networks are reachable, indirect access to internal resources.

The vulnerable product is TerriaJS-Server, the Node.js Express application used to provide a proxy service for TerriaJS. All releases earlier than version 4.0.3 are affected. Deployments that enable the proxy feature and configure any proxyableDomains list are vulnerable, regardless of user authentication or network restrictions.

The CVSS base score of 8.7 indicates high severity. The EPSS score is below 1 %, suggesting a low but nonzero likelihood of current exploitation. The vulnerability is not yet catalogued in the CISA KEV list. Attackers can remotely target the /proxy endpoint from any network that can reach the server, bypassing the domain allowlist and allowing unrestricted outbound HTTP requests. The exploitation requires only knowledge of the endpoint; no authentication is needed, making the risk readily exploitable.