| عنوان | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| الوصف | A Server-Side Request Forgery (SSRF) vulnerability exists in OpenBoxes versions v0.9.7 and lower. An authenticated user with basic privileges (Browser role) can exploit an unvalidated URL handling mechanism within the upload action of ProductController.groovy. By submitting an arbitrary internal or external URL to the params.url parameter, the application server fetches the resource using new URL().openStream(). Because the fetched response is automatically stored within a Document object associated with a product, the vulnerability is not blind; attackers can retrieve data directly via the product's document list UI or the download endpoint. This allows for internal network reconnaissance, access to non-internet-facing internal services, and credential theft from cloud metadata endpoints (e.g., AWS, GCP, Azure).
this was fixed on v0.9.8
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5944
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-828r-3vx8-65wx |
|---|
| المصدر | ⚠️ https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c |
|---|
| المستخدم | nedlir (UID 95981) |
|---|
| ارسال | 27/06/2026 03:18 PM (2 أشهر منذ) |
|---|
| الاعتدال | 15/08/2026 07:47 AM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 390178 [OpenBoxes حتى 0.9.7 Product Upload Endpoint ProductController.groovy upload params.url تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|