This vulnerability in Scripta eScriptorium affects the handling of METS and IIIF import URIs via the mets_uri or iiif_uri parameters in the POST /api/documents/{pk}/imports/ endpoint. Due to the default configuration of IMPORT_ALLOWED_DOMAINS as '*', an authenticated attacker can cause the server to issue HTTP requests to arbitrary internal hosts, including sensitive services such as cloud instance metadata endpoints. The lack of address filtering, redirect caps, and timeouts exacerbates the risk. The CVSS 3.1 base score is 8.5, indicating high severity with network attack vector, low attack complexity, requiring privileges, no user interaction, and impacts confidentiality highly, integrity partially, and no availability impact.

An authenticated remote attacker can leverage this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal network resources. This can lead to disclosure of sensitive internal information, including cloud instance metadata, which may facilitate further attacks or data exfiltration. The vulnerability impacts confidentiality significantly and integrity to a lesser extent, without affecting availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to review and restrict the IMPORT_ALLOWED_DOMAINS setting from the default '*' to a whitelist of trusted domains. Implement address filtering, limit redirects, and apply request timeouts to mitigate the risk of SSRF exploitation. Monitor for updates from the vendor regarding official patches or fixes.