Unauthenticated SSRF Vulnerability in Webstudio

Webstudio through version 0.296.0 contains an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. The flaw exists within the /cgi/image, /cgi/video, and /cgi/asset proxy routes when the RESIZE_ORIGIN environment variable is left unset. Because these endpoints do not properly validate user-supplied URLs before performing a request, an unauthenticated remote attacker can force the application to make arbitrary outbound HTTP requests from the server's context.

This vulnerability allows attackers to bypass network perimeters to access sensitive cloud instance metadata (e.g., AWS IMDS or GCP metadata services), interact with internal services that are not exposed to the internet, and conduct network reconnaissance of the host infrastructure. Defenders should ensure the RESIZE_ORIGIN environment variable is properly configured or upgrade to a patched version once available.

Impact

Successful exploitation allows for the exfiltration of sensitive cloud provider credentials via metadata services, unauthorized access to internal management interfaces, and infrastructure-wide network mapping. This poses a high risk to organizations hosting Webstudio in cloud environments where instance metadata is accessible.

Recommendation

• Ensure the RESIZE_ORIGIN environment variable is set to a restricted, known-good value to disable the vulnerable proxy behavior.
• Monitor webserver access logs for anomalous requests to /cgi/ endpoints that contain suspicious URL query parameters or private IP addresses.
• Restrict outbound network access from the Webstudio server to the cloud metadata service IP address (e.g., 169.254.169.254) using host-based firewalls or cloud security groups.
• Apply patches or updates from the vendor as soon as they are released to address the underlying input validation flaw in the proxy routes.