| 제목 | Jeeboot 3.9.2 Server-Side Request Forgery |
|---|
| 설명 | JeecgBoot AiragChatController SSRF and Information Disclosure Vulnerability
An issue was discovered in JeecgBoot version 3.9.2. The /airag/chat/send endpoint in org.jeecg.modules.airag.app.controller.AiragChatController allows unauthenticated remote attackers to conduct Server-Side Request Forgery (SSRF) and retrieve internal or remote document contents.
The endpoint is decorated with @IgnoreAuth and accepts a files parameter within the request body, which allows passing remote http/https file URLs. The backend handles this parameter by downloading the specified file, parsing its text content using Apache Tika, and appending the parsed text into the Large Language Model (LLM) context.
The vulnerability stems from an incomplete SSRF validation logic in org.jeecg.common.util.filter.SsrfFileTypeFilter. The current implementation only blocks loopback and link-local addresses, failing to restrict private IP address ranges such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.
Consequently, a remote attacker without a valid session or X-Access-Token can force the server to request files from internal HTTP services. If the target file matches an allowed document extension (e.g., txt, pdf, docx, doc, pptx, xlsx, md), its content will be processed and potentially disclosed to the attacker via the model's response.
The issue has been fixed. See the issue for details.
|
|---|
| 원천 | ⚠️ https://github.com/jeecgboot/JeecgBoot/issues/9672#issuecomment-4739323732 |
|---|
| 사용자 | s1ldyd (UID 98860) |
|---|
| 제출 | 2026. 06. 18. AM 09:52 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 05. PM 09:46 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 386382 [JeecgBoot 까지 3.9.2 Anonymous Chat Attachment Parser /airag/chat/send 권한 상승] |
|---|
| 포인트들 | 20 |
|---|