Invia #581704: JeeSite v5.11 Server-Side Request Forgeryinformazioni

TitoloJeeSite v5.11 Server-Side Request Forgery
DescrizioneA Server-Side Request Forgery (SSRF) and Arbitrary File Read vulnerability exists in JeeSite version 5.11.1 (Spring Boot 3) due to improper input validation of the name parameter in the /cms/fileTemplate/form endpoint. This parameter is propagated through multiple layers and ultimately passed into the Spring ResourceLoader.getResource() method, which accepts multiple URI schemes such as file:, http:, classpath:, etc. An attacker can exploit this chain to read local files or make arbitrary requests from the server.
Fonte⚠️ https://github.com/xiaoyangsec/JeeSite_SSRF/blob/main/jeesite5-ssrf-file-read.md
Utente
 xiaoyang (UID 84496)
Sottomissione20/05/2025 18:50 (1 Anno fa)
Moderazione25/05/2025 19:33 (5 days later)
StatoAccettato
Voce VulDB310274 [thinkgem JeeSite fino a 5.11.1 URI Scheme /cms/fileTemplate/form ResourceLoader.getResource Nome escalationi di privilegi]
Punti20

◂ PrecedenteVisione D'ensembleIl prossimo ▸

Are you interested in using VulDB?

Download the whitepaper to learn more about our service!