| タイトル | projeto-siga siga 5.4.10 through 11.1.1 server-side request forgery |
|---|
| 説明 | A vulnerability was identified in projeto-siga SIGA through the public HTML-to-PDF endpoint POST /sigaex/public/app/util/html-pdf. The endpoint calls assertPassword(), but authentication fails open when the optional util.webservice.password property is not configured: the request is rejected only when pwd != null and the Authorization header differs. The property has a null default and is absent from the official siga-docker standalone.xml.
The attacker-controlled html parameter reaches the Flying Saucer DownloadExterno.getUrl() implementation. This passes resource URLs directly to new SigaHTTP().fetch(uri, null, null, null). SigaHTTP opens an HttpURLConnection without validating destination IP ranges, without an allowlist, and with null connect/read timeouts. Its response reader consumes data until EOF.
A remote unauthenticated attacker can submit HTML containing an image or other resource whose URL points to loopback, private-network, link-local, or attacker-controlled services. The SIGA server then performs the HTTP request from its own network context. This can disclose reachable image resources, interact with internal unauthenticated GET endpoints, scan internal services, access metadata endpoints in applicable deployments, or exhaust application threads using slow/unbounded responses.
Runtime proof against commit c65f287e84f1a0626c79310da0245bc8abb3175c used a listener bound only to 127.0.0.1 and the real FlyingSaucer converter. The result was callback_count=1, pdf_bytes=1742, RESULT=VULNERABLE_SERVER_SIDE_FETCH_CONFIRMED.
PoC request:
POST /sigaex/public/app/util/html-pdf
Content-Type: application/x-www-form-urlencoded
conv=2&html=<html><head></head><body><img src="http://CONTROLLED-LISTENER/siga-ssrf.png"></body></html>
No Authorization header is required when the property is absent.
Affected file: sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java
Affected parameter: html
Network sink: siga-ex/src/main/java/br/gov/jfrj/itextpdf/FlyingSaucer.java and siga-base/src/main/java/br/gov/jfrj/siga/base/SigaHTTP.java
Confirmed affected versions: 5.4.10 through v11.1.1 and develop at c65f287e84f1a0626c79310da0245bc8abb3175c. No patched version is known.
CWE-918, CWE-306, CWE-400.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N (8.2 High).
Recommendation: fail closed when the service password is absent; require authentication; allow only required schemes and hosts; resolve and reject loopback, private, and link-local destinations; revalidate redirects; and enforce connect, read, and response-size limits.
Vendor notified publicly at https://github.com/projeto-siga/siga/issues/2492. Product source: https://github.com/projeto-siga/siga. |
|---|
| ソース | ⚠️ https://github.com/projeto-siga/siga/issues/2492 |
|---|
| ユーザー | volksec (UID 93050) |
|---|
| 送信 | 2026年07月25日 05:56 (1 月 ago) |
|---|
| モデレーション | 2026年09月06日 15:04 (1 month later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 399434 [projeto-siga 迄 11.1.1 HTML-to-PDF Endpoint ExUtilController.java DownloadExterno.getUrl html 特権昇格] |
|---|
| ポイント | 20 |
|---|