| 제목 | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| 설명 | A Server-Side Request Forgery (SSRF) vulnerability exists in OpenBoxes versions v0.9.7 and lower. An authenticated user with basic privileges (Browser role) can exploit an unvalidated URL handling mechanism within the upload action of ProductController.groovy. By submitting an arbitrary internal or external URL to the params.url parameter, the application server fetches the resource using new URL().openStream(). Because the fetched response is automatically stored within a Document object associated with a product, the vulnerability is not blind; attackers can retrieve data directly via the product's document list UI or the download endpoint. This allows for internal network reconnaissance, access to non-internet-facing internal services, and credential theft from cloud metadata endpoints (e.g., AWS, GCP, Azure).
this was fixed on v0.9.8
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5944
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-828r-3vx8-65wx |
|---|
| 원천 | ⚠️ https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c |
|---|
| 사용자 | nedlir (UID 95981) |
|---|
| 제출 | 2026. 06. 27. PM 03:18 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 15. AM 07:47 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 390178 [OpenBoxes 까지 0.9.7 Product Upload Endpoint ProductController.groovy upload params.url 권한 상승] |
|---|
| 포인트들 | 20 |
|---|