| tiêu đề | Jeecg JeecgBoot 3.8.0~v3.9.5 Server-Side Request Forgery |
|---|
| Mô tả | JeecgBoot 3.8.0last through 3.9.5 exposes the flow-run endpoint POST /jeecg-boot/airag/flow/run
without authentication. The controller method is annotated with @IgnoreAuth
(jeecg-aiflow-boot4, org/jeecg/modules/airag/flow/c/a.class), so the request is
whitelisted by JwtFilter before any token validation.
The endpoint loads a flow definition from the database by its identifier. The
default installation ships an enabled sample flow, 1900029596154232833, whose
HTTP nodes use the placeholder {{domainURL}}. When the flow executes, the HTTP
node component replaces {{domainURL}} with CommonUtils.getBaseUrl(request),
which is built verbatim from the HTTP Host header (request.getServerName() and
request.getServerPort()). The resulting URL is passed to
RestTemplate.exchange() without any scheme, host, port, DNS or private-IP
validation.
An unauthenticated attacker therefore controls the destination host and port of
a server-side HTTP request (including 127.0.0.1, RFC1918 addresses and the cloud
metadata address x.x.x.x). The response body of the target is written
back into the flow context and returned to the caller through the SSE stream,
which turns the issue into a full-read SSRF. If the attacker supplies an
X-Access-Token header, the flow engine also forwards it to the attacker-chosen
destination (component/j.class sets X-Access-Token and X-Tenant-Id), allowing
token exfiltration. |
|---|
| Nguồn | ⚠️ https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-01-airag-flow-ssrf.md |
|---|
| Người dùng | dptcc (UID 94330) |
|---|
| Đệ trình | 18/10/2026 05:57 (cách đây 25 ngày) |
|---|
| Kiểm duyệt | 12/11/2026 09:02 (25 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 436296 [JeecgBoot đến 3.9.6 flow-run Endpoint a.class RestTemplate.exchange nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|