This vulnerability allows attackers to bypass network perimeters to access sensitive cloud instance metadata (e.g., AWS IMDS or GCP metadata services), interact with internal services that are not exposed to the internet, and conduct network reconnaissance of the host infrastructure. Defenders should ensure the RESIZE_ORIGIN environment variable is properly configured or upgrade to a patched version once available.

Impact

Successful exploitation allows for the exfiltration of sensitive cloud provider credentials via metadata services, unauthorized access to internal management interfaces, and infrastructure-wide network mapping. This poses a high risk to organizations hosting Webstudio in cloud environments where instance metadata is accessible.

Recommendation

• Ensure the RESIZE_ORIGIN environment variable is set to a restricted, known-good value to disable the vulnerable proxy behavior.
• Monitor webserver access logs for anomalous requests to /cgi/ endpoints that contain suspicious URL query parameters or private IP addresses.
• Restrict outbound network access from the Webstudio server to the cloud metadata service IP address (e.g., 169.254.169.254) using host-based firewalls or cloud security groups.
• Apply patches or updates from the vendor as soon as they are released to address the underlying input validation flaw in the proxy routes.