The open-webSearch product by Aas-ee, before version 2.1.7, contains a Server-Side Request Forgery vulnerability (CWE-918) due to improper handling of bracketed IPv6 literals and lack of DNS resolution in URL safety checks (isPublicHttpUrl and assertPublicHttpUrl functions). This flaw enables attackers to induce the server to make HTTP requests to arbitrary internal or external resources and receive the response body, facilitating non-blind SSRF attacks. The vulnerability is addressed in version 2.1.7, which corrects the URL validation logic.

Successful exploitation allows an attacker to make the vulnerable server perform HTTP requests to arbitrary URLs, potentially accessing internal resources or sensitive data. The attacker can receive the response body, increasing the risk of information disclosure. The CVSS score of 8.2 reflects high confidentiality impact with limited integrity impact and no availability impact. There are no reports of active exploitation in the wild.

Upgrade open-webSearch to version 2.1.7 or later, where this SSRF vulnerability is fixed. Since no official vendor advisory is provided, patch status is inferred from the version fix note. Until upgrading, restrict access to the vulnerable service and monitor for unusual request patterns that could indicate SSRF attempts.