| शीर्षक | jeecgboot JeecgBoot <= v3.9.1 SSRF |
|---|
| विवरण | A Server-Side Request Forgery (SSRF) vulnerability exists in the /airag/app/debug endpoint of JeecgBoot. An authenticated attacker can provide arbitrary internal or external URLs via the files parameter in the request body. The server processes these URLs through AiragChatServiceImpl and uses FileDownloadUtils.download2DiskFromNet() to fetch the files. Because the application fails to validate the host or IP address of the provided URLs, it can be forced to make outbound HTTP requests to internal services, local ports, or cloud instance metadata endpoints (e.g., x.x.x.x). The vulnerability can be exploited even if an extension whitelist is present by appending a permitted extension (like .pdf) to the URL path.
|
|---|
| स्रोत | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9611 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 08/05/2026 04:19 PM (5 महीनों पहले) |
|---|
| संयम | 31/05/2026 11:56 AM (23 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 367519 [jeecgboot The server processes these URLs तक 3.9.1 Cloud Instance Metadata Endpoint /airag/app/debug FileDownloadUtils.download2DiskFromNet अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|