| 标题 | Jeecg JeecgBoot 3.8.0~v3.9.5 Server-Side Request Forgery |
|---|
| 描述 | JeecgBoot 3.8.0last through 3.9.5 exposes the flow-run endpoint POST /jeecg-boot/airag/flow/run
without authentication. The controller method is annotated with @IgnoreAuth
(jeecg-aiflow-boot4, org/jeecg/modules/airag/flow/c/a.class), so the request is
whitelisted by JwtFilter before any token validation.
The endpoint loads a flow definition from the database by its identifier. The
default installation ships an enabled sample flow, 1900029596154232833, whose
HTTP nodes use the placeholder {{domainURL}}. When the flow executes, the HTTP
node component replaces {{domainURL}} with CommonUtils.getBaseUrl(request),
which is built verbatim from the HTTP Host header (request.getServerName() and
request.getServerPort()). The resulting URL is passed to
RestTemplate.exchange() without any scheme, host, port, DNS or private-IP
validation.
An unauthenticated attacker therefore controls the destination host and port of
a server-side HTTP request (including 127.0.0.1, RFC1918 addresses and the cloud
metadata address x.x.x.x). The response body of the target is written
back into the flow context and returned to the caller through the SSE stream,
which turns the issue into a full-read SSRF. If the attacker supplies an
X-Access-Token header, the flow engine also forwards it to the attacker-chosen
destination (component/j.class sets X-Access-Token and X-Tenant-Id), allowing
token exfiltration. |
|---|
| 来源 | ⚠️ https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-01-airag-flow-ssrf.md |
|---|
| 用户 | dptcc (UID 94330) |
|---|
| 提交 | 2026-10-18 05時57分 (25 日前) |
|---|
| 管理 | 2026-11-12 09時02分 (25 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 436296 [JeecgBoot 直到 3.9.6 flow-run Endpoint a.class RestTemplate.exchange 权限提升] |
|---|
| 积分 | 20 |
|---|