CVE-2026-77112: Weoll SSRF Vulnerability

CVE-2026-77112 Overview

CVE-2026-77112 is a Server-Side Request Forgery (SSRF) vulnerability affecting Weoll, a product developed by Global IT Informatics Technology Services Inc. The flaw allows a remote attacker to coerce the application server into issuing crafted HTTP requests to arbitrary destinations. Successful exploitation requires user interaction, such as clicking a malicious link or loading attacker-supplied content. The vulnerability is classified under CWE-918: Server-Side Request Forgery and impacts all Weoll versions prior to 3.2.45.44.

Critical Impact
An attacker can abuse the Weoll server as a proxy to reach internal network resources, cloud metadata endpoints, or otherwise unreachable services, resulting in disclosure of sensitive data.

Affected Products

Global IT Informatics Technology Services Inc. Weoll — versions before 3.2.45.44

Discovery Timeline

2026-09-23 - CVE-2026-77112 published to NVD
2026-09-23 - Last updated in NVD database
Turkish National Cyber Incident Response Center advisory published as TR-26-1160

Technical Details for CVE-2026-77112

Vulnerability Analysis

Weoll accepts user-controllable input that is passed to a server-side HTTP client without adequate validation of the target destination. An attacker can supply a URL that causes the Weoll backend to fetch content from arbitrary hosts. This behavior enables reconnaissance and interaction with services that are not directly exposed to the internet. The attack requires network access to the Weoll instance and a user interaction step, but does not require authentication.

Root Cause

The root cause is missing or insufficient allow-list validation on URLs consumed by a server-side fetch operation. Without a strict allow-list of protocols, hostnames, and IP ranges, the backend follows attacker-supplied URLs to internal endpoints. This includes loopback interfaces, private network ranges (RFC 1918), link-local addresses used by cloud metadata services, and internal service DNS names. The absence of egress filtering compounds the exposure.

Attack Vector

Exploitation occurs over the network. The attacker crafts a payload containing a URL pointing to an internal target and delivers it through a Weoll feature that performs server-side fetching. When a user interacts with the crafted content, the Weoll backend performs the request on the attacker's behalf. The response, or observable side effects, can leak sensitive data such as internal service banners, configuration files, or cloud instance credentials retrieved from metadata endpoints. Because the confidentiality impact is high while integrity and availability are unaffected, the attack is oriented toward data disclosure rather than modification.

No public proof-of-concept exploit has been observed. Refer to the TR-26-1160 advisory for vendor-coordinated details.

Detection Methods for CVE-2026-77112

Indicators of Compromise

Outbound HTTP requests originating from the Weoll application server to internal IP ranges such as 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
Requests from the Weoll server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
Unusual DNS lookups from the Weoll backend for internal hostnames or attacker-controlled domains used for out-of-band SSRF confirmation.

Detection Strategies

Inspect Weoll application logs for URL parameters containing IP literals, encoded IPs, or non-standard URL schemes such as file://, gopher://, or dict://.
Correlate user-facing feature invocations that trigger server-side fetches with subsequent outbound connections from the Weoll host.
Monitor for spikes in server-initiated HTTP traffic that do not match documented integration destinations.

Monitoring Recommendations

Forward Weoll web server, application, and proxy logs to a centralized SIEM for URL and destination analysis.
Enable egress network flow logging on the segment hosting Weoll to detect connections to internal ranges and metadata services.
Alert on any authentication or credential retrieval events sourced from the Weoll service account outside expected workflows.

How to Mitigate CVE-2026-77112

Immediate Actions Required

Upgrade Weoll to version 3.2.45.44 or later on all affected instances.
Restrict outbound network access from the Weoll server to only the destinations required for business function.
Block Weoll host access to cloud metadata endpoints such as 169.254.169.254 at the network layer.
Audit recent Weoll activity for suspicious server-initiated requests to internal or metadata addresses.

Patch Information

The vendor has released Weoll version 3.2.45.44, which remediates CVE-2026-77112. All prior versions are affected. Coordination and advisory publication were handled through the Turkish National Cyber Incident Response Center; see TR-26-1160 for vendor guidance and download instructions.

Workarounds

Deploy an egress proxy in front of the Weoll application and enforce a strict allow-list of permitted destinations.
Configure host-based firewall rules to deny outbound traffic from the Weoll process to RFC 1918 and link-local ranges when not required.
Where feasible, disable or limit Weoll features that accept user-supplied URLs until the patch is applied.

bash

# Example iptables rules to block SSRF-relevant destinations from the Weoll host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP