| 标题 | Openboxes v0.9.7 Server-Side Request Forgery |
|---|
| 描述 | A Server-Side Request Forgery (SSRF) vulnerability exists in OpenBoxes versions v0.9.7 and lower. An authenticated user with basic privileges (Browser role) can exploit an unvalidated URL handling mechanism within the upload action of ProductController.groovy. By submitting an arbitrary internal or external URL to the params.url parameter, the application server fetches the resource using new URL().openStream(). Because the fetched response is automatically stored within a Document object associated with a product, the vulnerability is not blind; attackers can retrieve data directly via the product's document list UI or the download endpoint. This allows for internal network reconnaissance, access to non-internet-facing internal services, and credential theft from cloud metadata endpoints (e.g., AWS, GCP, Azure).
this was fixed on v0.9.8
timeline:
January 11, 2026 – Vulnerability discovered and reported to the OpenBoxes maintainers.
February 2, 2026 – Vulnerability acknowledged by the development team.
June 13, 2026 – Security patch officially released, fixing the unvalidated URL.openStream() call.
patch and fix: https://github.com/openboxes/openboxes/pull/5944
github advisory (not published) used to report: https://github.com/openboxes/openboxes/security/advisories/GHSA-828r-3vx8-65wx |
|---|
| 来源 | ⚠️ https://gist.github.com/nedlir/4eefb532d29cbb9a7091266fc1cbd55c |
|---|
| 用户 | nedlir (UID 95981) |
|---|
| 提交 | 2026-06-27 15時18分 (2 月前) |
|---|
| 管理 | 2026-08-15 07時47分 (2 months later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 390178 [OpenBoxes 直到 0.9.7 Product Upload Endpoint ProductController.groovy upload params.url 权限提升] |
|---|
| 积分 | 20 |
|---|