This vulnerability exploits an SSRF flaw in Halo’s /plugins/-/install-from-uri endpoint, which is reachable only by authenticated users. By sending a specially crafted GET request, an attacker can force the server to issue HTTP requests to arbitrary internal URLs, enabling the discovery and retrieval of sensitive data or services that are otherwise unreachable from the public network. The flaw provides a direct path for internal network reconnaissance and could be leveraged as a foothold for further attacks if internal resources are accessed or exfiltrated.

Halo version 2.22.14 is affected by the SSRF flaw in its install-from-uri endpoint. No other versions are explicitly listed; the vulnerability was identified in the specified release and may also affect earlier or later unreleased builds that contain unchanged code.

The vulnerability has a CVSS score of 5.4, and an EPSS value is not available. It is not listed in the CISA KEV catalog, indicating that there is no publicly reported exploitation data. Because the flaw requires user authentication but allows the server to contact internal resources, attackers with sufficient privileges could perform internal scanning or potentially access privileged services. The risk level remains moderate, contingent on the attacker’s ability to authenticate and the sensitivity of exposed internal resources; full exploitation would still require an authenticated user with permission to invoke the vulnerable endpoint.