| शीर्षक | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| विवरण | A Server-Side Request Forgery (SSRF) vulnerability exists in OpenBoxes versions v0.9.7 and lower. An authenticated user with basic privileges (Browser role) can exploit an unvalidated URL handling mechanism within the upload action of ProductController.groovy. By submitting an arbitrary internal or external URL to the params.url parameter, the application server fetches the resource using new URL().openStream(). Because the fetched response is automatically stored within a Document object associated with a product, the vulnerability is not blind; attackers can retrieve data directly via the product's document list UI or the download endpoint. This allows for internal network reconnaissance, access to non-internet-facing internal services, and credential theft from cloud metadata endpoints (e.g., AWS, GCP, Azure).
this was fixed on v0.9.8
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5944
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-828r-3vx8-65wx |
|---|
| स्रोत | ⚠️ https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c |
|---|
| उपयोगकर्ता | nedlir (UID 95981) |
|---|
| सबमिशन | 27/06/2026 03:18 PM (2 महीनों पहले) |
|---|
| संयम | 15/08/2026 07:47 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 390178 [OpenBoxes तक 0.9.7 Product Upload Endpoint ProductController.groovy upload params.url अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|