Executive brief
VitaraCharts and VitaraMaps, data visualization tools used with MicroStrategy, contain a security flaw that allows unauthorized individuals to send requests from the server. An attacker can use this to probe internal company networks that are not normally accessible from the internet or to read sensitive data from internal services. This could lead to information disclosure or serve as a stepping stone for further attacks on the internal infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in VitaraCharts version 5.3.5 and VitaraMaps version 5.3. The flaw is located in the fileLoader.jsp (Java) and fileLoader.aspx (.NET) endpoints, where the 'file' query string parameter is not properly validated. A remote, unauthenticated attacker can provide absolute URLs to this parameter, causing the server to issue arbitrary HTTP requests and return the full response to the attacker. This can be exploited to bypass access controls, access internal metadata services, or perform port scanning against internal hosts. A vendor fix was reportedly released in November 2025.
Affected products
- VitaraCharts VitaraCharts 5.3.5
- VitaraCharts VitaraMaps 5.3
Timeline
- 2025-06-12: other: Vulnerability discovered
- 2025-08-11: other: Vendor contacted (no response)
- 2025-10-02: disclosed: Public disclosure
- 2025-11-18: patched: Vendor fix released