CVE-2026-11437: go-fastdfs-web SSRF Vulnerability

CVE-2026-11437 Overview

CVE-2026-11437 is a Server-Side Request Forgery (SSRF) vulnerability in perfree go-fastdfs-web through version 1.3.7. The flaw resides in the checkServer function of the /install/checkServer endpoint within the Installation component. Attackers can manipulate request parameters to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is exploitable remotely without authentication, and a public exploit has been disclosed. The vendor was contacted prior to disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can abuse the installation endpoint to perform SSRF, enabling internal network reconnaissance and access to otherwise restricted services.

Affected Products

perfree go-fastdfs-web versions up to and including 1.3.7
Installation Endpoint component (/install/checkServer)
The checkServer function within the installation workflow

Discovery Timeline

2026-06-06 - CVE-2026-11437 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-11437

Vulnerability Analysis

The vulnerability is classified under CWE-918: Server-Side Request Forgery. The checkServer function exposed at /install/checkServer accepts a server address or URL parameter from the client. The application uses this attacker-controlled value to issue a server-side HTTP request without performing host validation, allow-listing, or scheme restriction.

Because the endpoint is part of the installation workflow, it is reachable before authentication is enforced. An attacker can supply internal IP addresses, loopback URLs, or cloud metadata endpoints. The server returns response data or behavior that can be observed by the attacker, enabling reconnaissance of internal network topology.

Exploit code has been published on VulDB and a public Notion writeup. The flaw is straightforward to weaponize and requires no special tooling.

Root Cause

The root cause is missing input validation on the server-address parameter consumed by checkServer. The function trusts user-supplied URLs and forwards them directly to an HTTP client. No filtering is performed against internal address ranges (RFC1918), loopback interfaces, or cloud provider metadata endpoints such as 169.254.169.254.

Attack Vector

A remote unauthenticated attacker sends a crafted HTTP request to /install/checkServer with a manipulated server parameter pointing at an internal target. The vulnerable application then performs an outbound request to the attacker-specified destination. The attacker can probe internal services, retrieve metadata, or pivot toward additional infrastructure exposed only to the application host.

The vulnerability is described in prose because no verified exploit code has been published in this disclosure. Refer to the Notion Analysis on SSRF in go-fastdfs for additional technical context.

Detection Methods for CVE-2026-11437

Indicators of Compromise

Inbound HTTP requests to /install/checkServer after the installation phase has completed
Outbound connections from the go-fastdfs-web host to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
Requests from the application host to cloud metadata services such as 169.254.169.254
Unusual user-agent patterns or repeated probing of the installation endpoint from a single source

Detection Strategies

Inspect web server access logs for any access to /install/checkServer on production instances
Correlate inbound requests to the installation endpoint with subsequent unexpected outbound HTTP traffic from the same host
Deploy web application firewall rules that flag parameters containing internal IP literals or metadata service hostnames
Monitor process-level network telemetry on hosts running go-fastdfs-web for connections initiated to non-standard internal destinations

Monitoring Recommendations

Enable egress filtering and log all outbound HTTP requests originating from the application host
Alert on any access attempts to installation or setup endpoints after initial deployment
Track DNS queries from the application server for external hostnames not associated with normal operation
Maintain network segmentation logs to identify lateral probing originating from web-tier hosts

How to Mitigate CVE-2026-11437

Immediate Actions Required

Restrict network access to the /install/checkServer endpoint using reverse proxy or firewall rules
Disable or remove the installation endpoint on production deployments once setup is complete
Apply egress filtering on the host running go-fastdfs-web to block requests to internal ranges and cloud metadata services
Review web server and application logs for prior exploitation attempts targeting the installation endpoint

Patch Information

No vendor patch is available at the time of disclosure. According to the public advisory, the vendor was contacted but did not respond. Operators should track the VulDB CVE-2026-11437 entry for updates and consider migrating to alternative file distribution components if no fix is released.

Workarounds

Block all external access to /install/* paths at the reverse proxy or load balancer
Implement an allow-list of permitted destination hosts for any server-side HTTP client calls
Deploy a host-level firewall policy preventing the application process from reaching RFC1918 ranges and 169.254.169.254
Place the application behind an authenticated gateway so unauthenticated requests cannot reach the installation routes

bash

# Example nginx configuration to block external access to the installation endpoint
location ~ ^/install/ {
    allow 127.0.0.1;
    deny all;
    return 403;
}