This vulnerability in Halo CMS 2.21's Thumbnail via-uri endpoint enables unauthenticated attackers to exploit SSRF by supplying arbitrary URIs. The server issues HTTP GET requests to these URIs without proper validation, potentially accessing internal resources. Additionally, the server returns a 307 redirect containing the requested URI in the Location header, which can disclose internal URLs. This behavior can be leveraged to probe internal network infrastructure or access otherwise restricted resources. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

An attacker can cause the vulnerable server to make HTTP requests to arbitrary URLs, including internal network addresses, potentially exposing internal services or sensitive information via the 307 redirect Location header. The vulnerability does not directly impact confidentiality beyond URL disclosure, nor does it affect integrity or availability. However, it may facilitate further attacks by revealing internal network topology or enabling indirect access to internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable endpoint if possible and implement network-level controls to limit outbound HTTP requests from the server to untrusted destinations. Monitor for unusual server request patterns that may indicate exploitation attempts.