This vulnerability in zhayujie CowAgent up to version 2.1.1 allows remote attackers to exploit the WebFetch.execute function by manipulating the url argument, resulting in server-side request forgery. This could enable attackers to make unauthorized requests from the server hosting CowAgent. The vulnerability has been publicly disclosed. The vendor released a fix in version 2.1.2 (commit ea47f3097eed4f8295c4cb3d76ecb97e0f43d632) to mitigate the issue.

Successful exploitation allows an attacker to cause the server to make arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further attacks depending on the internal network configuration. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts.

A fixed version 2.1.2 of zhayujie CowAgent is available and should be applied to remediate this vulnerability. Upgrading to version 2.1.2 fully mitigates the SSRF issue. No additional mitigation steps are indicated by the vendor.