The vulnerability in Vasion Print Virtual Appliance Host arises from insufficient validation of administrator-configured hostname fields passed to PHP's file_get_contents() and cURL functions. These functions follow HTTP redirects without enforcing allow-lists, scheme, or IP-range restrictions. An attacker with admin privileges can configure a hostname that redirects to internal cloud service endpoints, such as the AWS EC2 metadata service, causing the server to retrieve and expose sensitive metadata including IAM credentials. This enables credential theft, internal service enumeration, and lateral movement within the SaaS infrastructure. The issue is tracked as CWE-918 (Protection Mechanism Failure). The vulnerability is present in versions prior to 25.1.102 (host) and 25.1.1413 (application). The vendor has confirmed remediation, but the patch release date is unspecified. The service is cloud-hosted, and the vendor manages patching.

An attacker with administrator privileges can exploit this vulnerability to cause the server to follow malicious redirects to internal endpoints, such as the AWS EC2 metadata service, resulting in the disclosure of cloud IAM credentials. This can lead to unauthorized access to cloud resources, internal service enumeration, and potential lateral movement within the SaaS environment. The CVSS 4.0 score is 8.5, indicating high severity. There are no reports of known exploits in the wild at this time.

A patch addressing this vulnerability is available and has been confirmed by the vendor. Since this is a cloud-hosted service, the vendor manages remediation server-side. Security teams should verify with Vasion that their environment is running a patched version (25.1.102 or later for the host, 25.1.1413 or later for the application). Until confirmed, restrict administrator access to trusted personnel and review hostname configurations for suspicious entries. Check the vendor advisory for the latest remediation status and guidance.