CVE-2021-27670: Appspace SSRF via proxy jsonprequest URL parameter

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityThe flaw is network-reachable with no privileges or interaction required and has a public exploit plus very high EPSS, but it is not in KEV and the record lacks detail on real-world targeting.

What it is

Appspace 6.2.4 exposes an api/v1/core/proxy/jsonprequest endpoint whose url parameter can be pointed at arbitrary destinations, producing a server-side request forgery flaw (CWE-918). Because the request is proxied by the Appspace server, an attacker can make the server issue requests that appear to originate from inside the network. The record does not describe the affected deployment model or any preconditions beyond the version.

Impact

An attacker gains the ability to make the Appspace server send requests to internal or external systems on their behalf, which can expose internal services, reach cloud metadata endpoints, or bypass network access controls. The CVSS vector rates confidentiality, integrity and availability impact as high, though the record gives no detail on specific post-exploitation effects.

Attack surface

Reachable over the network through the api/v1/core/proxy/jsonprequest endpoint with the url parameter; the CVSS vector indicates no privileges and no user interaction are required. The record does not state whether the endpoint is exposed pre-authentication in all configurations.

Exploitation

Not listed in CISA KEV, but EPSS is 0.61274 (99.1st percentile), indicating a high modeled likelihood of exploitation activity. Both references are tagged Exploit and point to a public proof-of-concept, so working exploit code is publicly available.

What to do

• Upgrade Appspace from 6.2.4 to a fixed release as soon as the vendor's advisory identifies one; the record does not name a patched version.
• Restrict network access to the api/v1/core/proxy/jsonprequest endpoint and place the Appspace server behind controls that block outbound requests to internal ranges and cloud metadata addresses.
• Enforce egress filtering and allowlisting so the Appspace host cannot reach link-local, loopback, RFC1918 or metadata endpoints.
• If the proxy endpoint is not required, disable or block it at the reverse proxy or WAF.
• Monitor vendor advisories for this CVE and apply any configuration hardening guidance they publish.

Detection

• Review Appspace and reverse proxy logs for requests to api/v1/core/proxy/jsonprequest with url parameters pointing at internal, loopback or metadata addresses.
• Alert on outbound connections from the Appspace host to internal IP ranges, 169.254.169.254 or unexpected external hosts.
• Correlate spikes in requests to the proxy endpoint with unusual response sizes or error patterns that suggest internal service probing.
• Hunt for the public PoC request patterns from the referenced GitHub repository in web and proxy telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.