Technical impact
The Ech0 application includes an SSRF vulnerability in the fetchPeerConnectInfo function. The function accepts arbitrary URLs for internal service checks without validating them, allowing an authenticated user to request any target address. This can expose internal network services, retrieve cloud metadata, and potentially serve as a foothold for further attacks. The weakness is classified as CWE‑918.
Affected Systems
All installations of Ech0 prior to version 4.7.3 are affected. The vendor lin‑snow lists the product Ech0; no narrower version qualifiers are provided beyond the 4.7.3 release line. This includes all build numbers that precede the 4.7.3 release tag.
Risk and Exploitability
The CVSS v3 score is 8.3, indicating a high severity. Exploitation requires authenticated access, so the attacker must have valid credentials to craft the request. The EPSS score is unavailable, indicating no published measure of recent exploitation likelihood. The vulnerability is not yet in CISA's Known Exploited Vulnerabilities catalog. Attackers could exploit this by specifying a protected internal endpoint or a cloud metadata URL in the fetchPeerConnectInfo payload, causing the server to dispatch the request. The potential impact includes unauthorized data disclosure or further lateral movement.
