Security Insight: Security Enhancements in MIDAS v4.42

MIDAS Security Advisory

12th October 2026

Summary

 Vulnerabilities were discovered and responsibly disclosed to our security team by an independent security researcher.

The vulnerabilities affect the MIDAS Server Readiness Tool (servercheck.pl), a separate tool available to download from our website to help self-hosted customers check that their server is ready for MIDAS. The tool is not part of MIDAS itself, is not required in order to install or run MIDAS, and is not included with MIDAS builds.

Three issues are described in this advisory:

  1. Issue 1 - Unauthenticated installation of Perl modules: In affected versions of the tool, if a copy was left in a location reachable by an attacker, an unauthenticated remote user could cause the tool to download, build and install Perl modules on the server, running as the web server user.
  2. Issue 2 - Disclosure of installation log: The tool's installation log was written to a location where, depending on the web server's configuration, it could be read by anyone, and could reveal the server's file paths and account name.
  3. Issue 3 - Server-side requests directed at other hosts: The tool's image and SVG checks built a request URL from the client-supplied Host header, and the connectivity check could be routed through a proxy address supplied in the request. An unauthenticated remote user could therefore make the server connect to hosts and ports of their choosing, and could learn whether those connections succeeded. The requests used fixed paths and returned only a status or error, so no data could be read from, or code run on, the target.

Exposure depends on whether the tool was left reachable by untrusted users or networks. Servers where it was only reachable on a private network are at lower risk, but we still recommend deleting it.

Our security team are not aware of any public disclosure or malicious use of the vulnerabilities that are described in this advisory.


Common Vulnerability Scoring System Assessment

 Our security team have internally assessed these vulnerabilities against the Common Vulnerability Scoring System (CVSS v3.1). The scores below describe an affected copy of the tool that is reachable by an attacker. Customers can apply their own environmental metrics to reflect their server's network exposure.

Issue 1 - Unauthenticated installation of Perl modules

8.8
(High)
It has been classified with a score of 8.8 (High). The base score, before taking account of the availability of an official fix, is 9.8.

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Issue 2 - Disclosure of installation log

3.6
(Low)
It has been classified with a score of 3.6 (Low). Attack complexity is rated High because whether the log can be read depends on how the customer's web server serves files of that type, which is outside an attacker's control.

Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/RL:O/RC:C

Issue 3 - Server-side requests directed at other hosts

5.6
(Medium)
It has been classified with a score of 5.6 (Medium). Confidentiality impact is rated Low because the only information an attacker could obtain is whether a connection to a host and port succeeded. The request paths were fixed and no data could be read from the target.

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/RL:O/RC:C


Affected Products

Vulnerable Products

Products Confirmed Not Vulnerable


What You Should Do

Workarounds

 Deleting servercheck.pl from your server, or preventing access to it via your web server configuration, fully mitigates all three vulnerabilities.

Timeline

Acknowledgements

Times shown are UTC unless otherwise stated