CVE-2026-10771: crmeb_java SSRF Vulnerability Explained

CVE-2026-10771 Overview

CVE-2026-10771 is a server-side request forgery (SSRF) vulnerability in CRMEB crmeb_java version 1.4. The flaw resides in the RestTemplate.getForEntity function located in crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java, which is reachable through the base64 QR code endpoint. An attacker can manipulate the url argument to coerce the server into issuing arbitrary outbound HTTP requests. The attack is executed remotely without authentication, and a public exploit has been disclosed. The maintainers were notified through an issue report but have not responded.

Critical Impact
Unauthenticated attackers can pivot through the affected server to reach internal services, cloud metadata endpoints, and otherwise unreachable resources.

Affected Products

CRMEB crmeb_java version 1.4
Component: base64 QR code endpoint
File: crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java

Discovery Timeline

2026-06-03 - CVE-2026-10771 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-10771

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery ([CWE-918]). The CRMEB Java e-commerce platform exposes a base64 QR code endpoint that accepts a user-supplied url parameter. That parameter flows directly into the RestTemplate.getForEntity call inside RestTemplateUtil.java without validation of the destination host, scheme, or address range.

Because the request originates from the application server, an attacker can target hosts inside the private network, loopback services, and cloud instance metadata endpoints such as 169.254.169.254. The server then returns the response content, which is encoded into a QR code image and returned to the attacker.

Root Cause

The root cause is missing input validation on the url argument passed to RestTemplate.getForEntity. The utility method trusts any URL the caller provides and performs no allowlisting of hosts, no blocking of internal IP ranges, and no scheme restriction. Combined with an unauthenticated endpoint, this turns a QR code generator into a generic outbound HTTP proxy.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends a crafted HTTP request to the base64 QR code endpoint, supplying a target URL in the url parameter. The server fetches the supplied URL using its own network identity and returns data derived from the response. This enables reconnaissance of internal infrastructure, retrieval of cloud credentials from metadata services, and interaction with non-public HTTP APIs.

No verified exploit code is reproduced here. Refer to the VulDB advisory for CVE-2026-10771 and the GitHub issue discussion for additional technical context.

Detection Methods for CVE-2026-10771

Indicators of Compromise

Inbound HTTP requests to the base64 QR code endpoint containing a url parameter pointing to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 127.0.0.1.
Outbound HTTP requests from the CRMEB application server to cloud metadata endpoints such as 169.254.169.254.
Unexpected outbound traffic from the application server to non-business destinations correlated with QR code endpoint activity.

Detection Strategies

Inspect application access logs for repeated calls to the base64 QR code endpoint with varying url values, especially those targeting RFC1918 addresses or link-local addresses.
Correlate web server logs with egress firewall logs to identify requests where an external client triggers internal lookups via the application.
Alert on any HTTP client traffic from the crmeb_java host that does not match an established baseline of legitimate outbound destinations.

Monitoring Recommendations

Enable verbose logging on RestTemplateUtil to capture each URL passed to getForEntity along with the requesting client IP.
Forward application and egress logs to a centralized analytics platform and build queries to flag SSRF probing patterns.
Monitor cloud metadata service access from workloads that have no operational reason to query it.

How to Mitigate CVE-2026-10771

Immediate Actions Required

Restrict access to the base64 QR code endpoint behind authentication or remove it from internet-facing deployments until a fix is available.
Apply egress filtering on the application server to block traffic to internal IP ranges, loopback, and cloud metadata addresses.
Audit application logs for prior exploitation attempts referencing the vulnerable endpoint.

Patch Information

No official patch has been released. According to the disclosure, the project was notified through an issue report but has not responded. Track the crmeb_java GitHub repository and issue #35 for updates.

Workarounds

Implement a strict URL allowlist in RestTemplateUtil.getForEntity, rejecting any host that resolves to a private, loopback, or link-local address.
Enforce scheme restrictions, accepting only http and https and blocking file, gopher, ftp, and other protocols.
Place the application behind a forward proxy that enforces destination policy for all outbound HTTP calls.
Apply network segmentation so the CRMEB server cannot reach sensitive internal services or cloud metadata endpoints.

bash

# Example egress restriction using iptables to block SSRF targets
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT