CVE-2026-2945
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in JeecgBoot 3.9.0 that allows attackers to make the server send HTTP requests to arbitrary internal or external systems. Attackers can exploit this remotely by manipulating the fileUrl parameter in the /sys/common/uploadImgByHttp endpoint. Any organization running the vulnerable JeecgBoot version is affected.
💻 Affected Systems
- JeecgBoot
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, perform port scanning of internal networks, or chain with other vulnerabilities to achieve remote code execution.
Likely Case
Information disclosure from internal services, potential data exfiltration, and reconnaissance of internal network infrastructure.
If Mitigated
Limited impact with proper network segmentation, egress filtering, and input validation controls in place.
🎯 Exploit Status
Exploit code is publicly available according to the references. The vulnerability can be exploited remotely without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided
Restart Required: No
Instructions:
No official patch available. The vendor did not respond to disclosure. Consider upgrading to a newer version if available or implementing workarounds.
🔧 Temporary Workarounds
Block vulnerable endpoint
allRestrict access to the /sys/common/uploadImgByHttp endpoint using web application firewall rules or access controls.
# Example for Apache: RewriteRule ^/sys/common/uploadImgByHttp - [F]
# Example for Nginx: location ~ ^/sys/common/uploadImgByHttp { deny all; }
Input validation and URL filtering
allImplement strict validation of the fileUrl parameter to only allow trusted domains and protocols.
# Application-level validation required in source code
🧯 If You Can't Patch
- Implement network segmentation to restrict the server's outbound connections to only necessary services
- Deploy a web application firewall with SSRF protection rules and monitor for suspicious requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Test if the /sys/common/uploadImgByHttp endpoint accepts arbitrary URLs in the fileUrl parameter and makes external requests.Check Version:
Check the JeecgBoot version in application configuration or via version endpoint if available.Verify Fix Applied:
Verify that the endpoint no longer accepts arbitrary URLs or that requests to internal resources are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the server
- Requests to internal IP addresses or unusual domains from the vulnerable endpoint
- Multiple failed attempts to access the uploadImgByHttp endpoint
Network Indicators:
- Unexpected outbound HTTP traffic from the JeecgBoot server to internal services
- Port scanning activity originating from the server
SIEM Query:
source_ip=jeecgboot_server AND (dest_ip=internal_range OR dest_domain=unusual_domain) AND uri_path="/sys/common/uploadImgByHttp"