This SSRF vulnerability in malach-it Boruta affects versions from 2.3.2 before 2.3.7. Three distinct code paths accept remote URIs from unauthenticated requests without adequate validation: the OAuth request_uri parameter, the jwks_uri in OpenID Connect dynamic client registration, and the refresh of stored jwks_uri for existing clients. The server does not enforce HTTPS, host or IP allowlists, or reject private, loopback, or link-local addresses after DNS resolution. It also does not limit response size or redirects. Consequently, an attacker can coerce the server to send HTTP requests to arbitrary network targets accessible from the Boruta host, potentially exposing internal resources.

An unauthenticated attacker can exploit this SSRF vulnerability to make the Boruta authorization server send HTTP requests to attacker-chosen URIs, including internal network services and cloud metadata endpoints. This may lead to unauthorized information disclosure or further internal network attacks depending on the network environment and accessible services. The vulnerability does not require user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch has been documented as of the provided data. Until a patch is available, restrict network access to the Boruta server to trusted networks only and monitor for unusual outbound HTTP requests. Avoid exposing Boruta instances to untrusted networks. Follow vendor advisories for updates on remediation.