DataGear Server-Side Request Forgery in /dataSet/preview/Http

DataGear through version 6.0.0 contains a critical server-side request forgery (SSRF) vulnerability located within the /dataSet/preview/Http endpoint. This vulnerability allows an unauthenticated remote attacker to force the DataGear application to initiate unauthorized HTTP requests to arbitrary targets, including internal network infrastructure, internal services, and cloud environment metadata services.

The application fails to validate the user-supplied URI parameter before executing the request, enabling support for various HTTP methods such as GET, POST, PUT, PATCH, and DELETE. Successful exploitation results in the disclosure of internal network configuration, service responses, and sensitive data that is otherwise unreachable from the public internet. Because the application returns the full response body of the requested resource to the attacker, this flaw presents a high risk for data exfiltration and internal reconnaissance. Defenders must prioritize restricting outbound network access from the DataGear server and ensuring the application is updated once a patch is available.