إرسال #581704: JeeSite v5.11 Server-Side Request Forgeryالمعلومات

عنوانJeeSite v5.11 Server-Side Request Forgery
الوصفA Server-Side Request Forgery (SSRF) and Arbitrary File Read vulnerability exists in JeeSite version 5.11.1 (Spring Boot 3) due to improper input validation of the name parameter in the /cms/fileTemplate/form endpoint. This parameter is propagated through multiple layers and ultimately passed into the Spring ResourceLoader.getResource() method, which accepts multiple URI schemes such as file:, http:, classpath:, etc. An attacker can exploit this chain to read local files or make arbitrary requests from the server.
المصدر⚠️ https://github.com/xiaoyangsec/JeeSite_SSRF/blob/main/jeesite5-ssrf-file-read.md
المستخدم
 xiaoyang (UID 84496)
ارسال20/05/2025 06:50 PM (1 سنة منذ)
الاعتدال25/05/2025 07:33 PM (5 days later)
الحالةتمت الموافقة
إدخال VulDB310274 [thinkgem JeeSite حتى 5.11.1 URI Scheme /cms/fileTemplate/form ResourceLoader.getResource الأسم تجاوز الصلاحيات]
النقاط20

التالي ▸نظرة عامة◂ السابق

Do you know our Splunk app?

Download it now for free!