| शीर्षक | JeeSite v5.11 Server-Side Request Forgery |
|---|
| विवरण | A Server-Side Request Forgery (SSRF) and Arbitrary File Read vulnerability exists in JeeSite version 5.11.1 (Spring Boot 3) due to improper input validation of the name parameter in the /cms/fileTemplate/form endpoint. This parameter is propagated through multiple layers and ultimately passed into the Spring ResourceLoader.getResource() method, which accepts multiple URI schemes such as file:, http:, classpath:, etc. An attacker can exploit this chain to read local files or make arbitrary requests from the server. |
|---|
| स्रोत | ⚠️ https://github.com/xiaoyangsec/JeeSite_SSRF/blob/main/jeesite5-ssrf-file-read.md |
|---|
| उपयोगकर्ता | xiaoyang (UID 84496) |
|---|
| सबमिशन | 20/05/2025 06:50 PM (1 वर्ष पहले) |
|---|
| संयम | 25/05/2025 07:33 PM (5 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 310274 [thinkgem JeeSite तक 5.11.1 URI Scheme /cms/fileTemplate/form ResourceLoader.getResource नाम अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|