The vulnerability exists in NukeViet's includes/ini.php and vendor/vinades/nukeviet/Core/Server.php components where the server_info_update() function issues a cURL request using the X-Forwarded-Host and X-Forwarded-Proto headers without validation. The standardizeHost() function's regex-based port stripping can be bypassed by appending a slash, allowing attacker-controlled host:port values to reach the cURL sink. The __serverInfoUpdate=1 POST request triggers this behavior before authentication. The SSRF is blind and restricted to a fixed HEAD request path, preventing direct data exfiltration or cloud metadata access. The issue is mitigated by validating and normalizing forwarded headers using parse_url(), restricting X-Forwarded-Proto to http/https, validating X-Forwarded-Port numerically, and enforcing host checks against configured domains (my_domains).

An unauthenticated attacker can cause the server to make arbitrary HTTP HEAD requests to attacker-chosen internal or external hosts and ports. This enables internal host and port discovery and poisoning of cached server response headers, which may affect site behavior. The SSRF is blind and limited to a fixed request path, so it does not allow direct data exfiltration, cloud metadata access, or remote code execution. The overall impact is rated high due to the unauthenticated nature and potential for internal network reconnaissance and cache poisoning.

A fix is available in NukeViet version 4.6.00 and later, which validates and normalizes the X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers, and enforces host checks against the configured my_domains list before processing the server_info_update() request. Until upgrading, administrators should configure reverse proxies or web servers to strip or override client-supplied X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port headers and ensure my_domains is correctly configured with the site's canonical domains.