CVE-2025-60319: Perfree Perfreeblog SSRF Vulnerability

CVE-2025-60319 Overview

CVE-2025-60319 is a Server-Side Request Forgery (SSRF) vulnerability in PerfreeBlog v4.0.11. The flaw resides in the uploadAttachByUrl API endpoint implemented in AttachController.java. The endpoint lacks an authorization check, allowing unauthenticated attackers to instruct the server to fetch arbitrary URLs. This exposes internal network resources and cloud metadata services to remote attackers. The vulnerability is tracked under [CWE-918] Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can abuse the vulnerable endpoint to make the PerfreeBlog server issue HTTP requests to internal systems, enabling reconnaissance of private networks and access to otherwise unreachable services.

Affected Products

Perfree PerfreeBlog 4.0.11
Deployments exposing the /uploadAttachByUrl endpoint without authorization enforcement
Instances built from the perfree-system-biz module prior to commit 103c791

Discovery Timeline

2025-10-30 - CVE-2025-60319 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60319

Vulnerability Analysis

The vulnerability exists in the uploadAttachByUrl handler within perfree-system/perfree-system-biz/src/main/java/com/perfree/controller/auth/attach/AttachController.java. The handler accepts a user-supplied URL through the AttachUploadByUrlVO request body and passes it directly to attachService.uploadAttachByUrl(). The server then downloads the resource at that URL and stores it as an attachment.

Before the patch, the endpoint carried no permission annotation. Any network client that could reach the API could trigger outbound HTTP requests originating from the PerfreeBlog server. Attackers use this behavior to probe internal services, access cloud instance metadata endpoints, and enumerate hosts behind perimeter controls.

Root Cause

The root cause is a missing authorization check on a sensitive URL-fetching endpoint. Method-level security annotations such as @PreAuthorize were absent, so Spring Security did not enforce administrative privileges before invoking the download logic. The application also performed no allowlist validation on the supplied URL scheme or host.

Attack Vector

An attacker sends a crafted POST request to /uploadAttachByUrl containing a target URL in the JSON body. The server dereferences the URL server-side, returning metadata about the fetched resource. Attackers target internal IP ranges, 169.254.169.254 metadata endpoints, and non-HTTP schemes where the underlying client supports them.

java

// Security patch applied in commit 103c79165e3a41a1729188fdc8a1e90c97c0a06d
@PostMapping("/uploadAttachByUrl")
@Operation(summary = "通过url下载并上传附件")
@DemoMode
@PreAuthorize("@ss.hasPermission('admin:attach:update')")
public CommonResult<AttachByUrlRespVO> uploadAttachByUrl(@Valid @RequestBody AttachUploadByUrlVO attachUploadByUrlVO) {
    Attach attach = attachService.uploadAttachByUrl(attachUploadByUrlVO.getUrl());
    AttachByUrlRespVO attachByUrlRespVO = AttachConvert.INSTANCE.convertByUrlRespVO(attach);
    // ...
}

Source: PerfreeBlog GitHub Commit 103c791. The added @PreAuthorize("@ss.hasPermission('admin:attach:update')") annotation requires administrative permissions before the endpoint executes.

Detection Methods for CVE-2025-60319

Indicators of Compromise

Unauthenticated POST requests to /uploadAttachByUrl in PerfreeBlog access logs
Outbound HTTP requests from the PerfreeBlog server to RFC1918 addresses or 169.254.169.254
Attach records referencing internal hostnames, loopback addresses, or non-standard ports
Repeated requests with varying url payload values from a single external source

Detection Strategies

Inspect web server logs for POST requests to /uploadAttachByUrl that lack a valid administrative session cookie or bearer token
Correlate application logs with egress network flows to identify server-initiated requests to internal or metadata addresses
Alert on newly created Attach database records whose source URL targets private address ranges

Monitoring Recommendations

Enable verbose logging on the AttachController class to capture URL parameters submitted to the endpoint
Deploy egress filtering rules that block PerfreeBlog application servers from initiating connections to internal management networks and cloud metadata endpoints
Monitor for anomalous spikes in attachment creation volume that indicate automated SSRF probing

How to Mitigate CVE-2025-60319

Immediate Actions Required

Apply the upstream patch from commit 103c791 that adds the @PreAuthorize check to uploadAttachByUrl
Restrict /uploadAttachByUrl at the reverse proxy layer so only authenticated administrator sessions can reach it
Enforce network egress restrictions on PerfreeBlog hosts to block traffic to internal management ranges and cloud metadata IPs
Audit existing Attach records for entries sourced from suspicious internal URLs and remove them

Patch Information

The fix is available in the PerfreeBlog upstream repository via commit 103c79165e3a41a1729188fdc8a1e90c97c0a06d. The patch adds @PreAuthorize("@ss.hasPermission('admin:attach:update')") to the uploadAttachByUrl handler in AttachController.java. Details are tracked in PerfreeBlog Issue #20. Operators running v4.0.11 should upgrade to a build that includes this commit.

Workarounds

Block requests to /uploadAttachByUrl at the web application firewall or reverse proxy when the request lacks a valid administrator authentication token
Implement an outbound URL allowlist on the application host that permits only known object storage or CDN destinations
Disable the attachment-by-URL feature entirely if administrative uploads are not required in the environment

bash

# Example nginx location block restricting the vulnerable endpoint
location = /uploadAttachByUrl {
    if ($http_authorization = "") { return 401; }
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://perfreeblog_backend;
}