| शीर्षक | https://github.com/jeecgboot JeecgBoot 3.9.2 Server-Side Request Forgery |
|---|
| विवरण | The /airag/chat/send interface of JeecgBoot lacks intranet address filtering. The files parameter can trigger arbitrary internal/external network requests, leading to SSRF vulnerability. Attackers can scan intranet services and read local files.
The target system suffers from a Server-Side Request Forgery (SSRF) vulnerability. The backend server fetches external resources based on controllable user input without sufficient validation and filtering of target request addresses. Attackers can manipulate the input parameter to construct arbitrary URLs, forcing the server to initiate requests to internal network assets, local services, or external third-party servers. |
|---|
| स्रोत | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9774 |
|---|
| उपयोगकर्ता | 0kam1 (UID 99762) |
|---|
| सबमिशन | 13/07/2026 05:20 PM (3 महीनों पहले) |
|---|
| संयम | 29/08/2026 04:43 PM (2 months later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 391434 [JeecgBoot 3.9.2 AI Chat अधिकार वृद्धि] |
|---|
| अंक | 0 |
|---|