| शीर्षक | jishenghua jshERP <=3.6 SSRF |
|---|
| विवरण | A stored Server-Side Request Forgery (SSRF) vulnerability in jshERP-boot allows administrative users to trigger arbitrary outbound HTTP GET requests. An attacker can submit a malicious URL via the POST /platformConfig/add endpoint (or update via /platformConfig/update) by setting the platformKey to weixinUrl and the platformValue to an internal or external target. This value is persisted in the jsh_platform_config table. When the system subsequently invokes WeChat-related functions (such as getAccessToken, getUserByWeixinCode, or weixinBind), it retrieves the stored URL and passes it to HttpClient.httpGet() without validation. This enables an attacker to probe internal services, access cloud metadata endpoints, or bypass network restrictions.
|
|---|
| स्रोत | ⚠️ https://github.com/jishenghua/jshERP/issues/155 |
|---|
| उपयोगकर्ता | Ana10gy (UID 93358) |
|---|
| सबमिशन | 20/05/2026 06:23 AM (5 महीनों पहले) |
|---|
| संयम | 07/06/2026 11:27 AM (18 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 369089 [jishenghua jshERP तक 3.6 platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig platformValue अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|