| Title | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| Description | A Server-Side Request Forgery (SSRF) vulnerability exists in OpenBoxes versions v0.9.7 and lower. An authenticated user with basic privileges (Browser role) can exploit an unvalidated URL handling mechanism within the upload action of ProductController.groovy. By submitting an arbitrary internal or external URL to the params.url parameter, the application server fetches the resource using new URL().openStream(). Because the fetched response is automatically stored within a Document object associated with a product, the vulnerability is not blind; attackers can retrieve data directly via the product's document list UI or the download endpoint. This allows for internal network reconnaissance, access to non-internet-facing internal services, and credential theft from cloud metadata endpoints (e.g., AWS, GCP, Azure).
this was fixed on v0.9.8
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5944
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-828r-3vx8-65wx |
|---|
| Source | ⚠️ https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c |
|---|
| User | nedlir (UID 95981) |
|---|
| Submission | 06/27/2026 15:18 (2 months ago) |
|---|
| Moderation | 08/15/2026 07:47 (2 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 390178 [OpenBoxes up to 0.9.7 Product Upload Endpoint ProductController.groovy upload params.url server-side request forgery] |
|---|
| Points | 20 |
|---|