CVE-2026-1062
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in xiweicheng TMS up to version 2.28.0. Attackers can manipulate URL parameters to make the server perform unauthorized requests to internal systems. Organizations using affected versions of this TMS software are vulnerable to exploitation.
💻 Affected Systems
- xiweicheng TMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other internal systems through the vulnerable server.
Likely Case
Information disclosure from internal services, potential credential theft from metadata services, or scanning of internal networks.
If Mitigated
Limited impact with proper network segmentation and egress filtering, though some information disclosure may still occur.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: Yes
Instructions:
1. Check for vendor updates or patches for xiweicheng TMS. 2. Upgrade to a version above 2.28.0 if available. 3. Restart the application after patching.
🔧 Temporary Workarounds
Input Validation and Sanitization
allImplement strict validation of URL parameters in the HtmlUtil.java Summary function
Modify src/main/java/com/lhjz/portal/util/HtmlUtil.java to validate URL parameters
Network Egress Filtering
linuxRestrict outbound connections from the TMS server to only necessary destinations
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block SSRF patterns
- Isolate the TMS server in a restricted network segment with limited egress
🔍 How to Verify
Check if Vulnerable:
Check the version of xiweicheng TMS deployed. If version is 2.28.0 or lower, the system is vulnerable.Check Version:
Check application configuration files or deployment manifests for version informationVerify Fix Applied:
Test the Summary function with SSRF payloads to confirm they are blocked or sanitized.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the TMS server
- Requests to internal IP addresses or metadata services
Network Indicators:
- HTTP requests from TMS server to unexpected internal destinations
- Patterns of requests to cloud metadata endpoints
SIEM Query:
source_ip=TMS_SERVER AND (dest_ip=169.254.169.254 OR dest_ip=metadata.google.internal OR dest_ip IN [INTERNAL_RANGES])🔗 References
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/SSRF%EF%BC%881%EF%BC%89.md
- https://github.com/bkglfpp/CVE-md/blob/main/%E5%95%86%E6%88%B7%E5%95%86%E5%9F%8E%E2%80%94%E5%95%86%E5%9F%8E%E5%BC%80%E5%8F%91tms/SSRF%EF%BC%882%EF%BC%89.md
- https://vuldb.com/?ctiid.341630
- https://vuldb.com/?id.341630
- https://vuldb.com/?submit.731241
- https://vuldb.com/?submit.731242
