Security Insight: Security Enhancements in MIDAS v4.42

MIDAS Security Advisory

12th October 2026

Updated 1st November 2026: clarified Issue 3 to state that the tool's optional proxy setting is retained by design. See Issue 3 below.

Summary

 Vulnerabilities were discovered and responsibly disclosed to our security team by an independent security researcher.

The vulnerabilities affect the MIDAS Server Readiness Tool (servercheck.pl), a separate tool available to download from our website to help self-hosted customers check that their server is ready for MIDAS. The tool is not part of MIDAS itself, is not required in order to install or run MIDAS, and is not included with MIDAS builds.

Three issues are described in this advisory:

  1. Issue 1 - Unauthenticated installation of Perl modules: In affected versions of the tool, if a copy was left in a location reachable by an attacker, an unauthenticated remote user could cause the tool to download, build and install Perl modules on the server, running as the web server user.
  2. Issue 2 - Disclosure of installation log: The tool's installation log was written to a location where, depending on the web server's configuration, it could be read by anyone, and could reveal the server's file paths and account name.
  3. Issue 3 - Server-side requests directed at other hosts: The tool's image and SVG checks built a request URL from the client-supplied Host header (and, in some configurations, a client-influenced port). An unauthenticated remote user could therefore make the server connect to hosts and ports of their choosing, and could learn whether those connections succeeded. The requests used fixed paths and returned only a status or error, so no data could be read from, or code run on, the target. This is fixed in v1.44. The tool's optional proxy setting, which is needed by customers who connect to the internet through a proxy, is retained by design (see the assessment below).

Exposure depends on whether the tool was left reachable by untrusted users or networks. Servers where it was only reachable on a private network are at lower risk, but we still recommend deleting it.

Our security team are not aware of any public disclosure or malicious use of the vulnerabilities that are described in this advisory.


Common Vulnerability Scoring System Assessment

 Our security team have internally assessed these vulnerabilities against the Common Vulnerability Scoring System (CVSS v3.1). The scores below describe an affected copy of the tool that is reachable by an attacker. Customers can apply their own environmental metrics to reflect their server's network exposure.

Issue 1 - Unauthenticated installation of Perl modules

8.8
(High)
It has been classified with a score of 8.8 (High). The base score, before taking account of the availability of an official fix, is 9.8.

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

Issue 2 - Disclosure of installation log

3.6
(Low)
It has been classified with a score of 3.6 (Low). Attack complexity is rated High because whether the log can be read depends on how the customer's web server serves files of that type, which is outside an attacker's control.

Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/RL:O/RC:C

Issue 3 - Server-side requests directed at other hosts

5.6
(Medium)
It has been classified with a score of 5.6 (Medium). This score describes the Host-header and port behaviour that was fixed in v1.44. Confidentiality impact is rated Low because the only information an attacker could obtain is whether a connection to a host and port succeeded. The request paths were fixed and no data could be read from the target.

Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/RL:O/RC:C

Optional proxy setting (retained): The tool allows a proxy address to be supplied so that customers who connect to the internet through a proxy can run its connectivity test. A requester can supply a proxy address in the same way, which is then used for a single fixed request to our own server. We have removed the underlying connection error from the test's failure message when a proxy is supplied. We do not consider the retained setting to be a vulnerability: nothing sensitive is sent through the proxy, no data can be read from any target, and the most a requester can learn is whether a working proxy responds at a given address. We assess the residual impact as Low.


Affected Products

Vulnerable Products

Products Confirmed Not Vulnerable


What You Should Do

Workarounds

 Deleting servercheck.pl from your server, or preventing access to it via your web server configuration, fully mitigates all three vulnerabilities, and the retained proxy setting.

Timeline

Acknowledgements

Times shown are UTC unless otherwise stated