CVE-2026-11469 Overview
CVE-2026-11469 is a server-side request forgery (SSRF) vulnerability in jishenghua jshERP through version 3.6. The flaw resides in the insertPlatformConfig function within jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java, reachable through the platformConfig Add Endpoint. An authenticated attacker can manipulate the platformValue argument to coerce the server into issuing arbitrary outbound HTTP requests. The exploit has been published, and the project maintainers have not responded to the issue report. The weakness is classified under CWE-918.
Critical Impact
Authenticated attackers can abuse the affected endpoint to perform SSRF against internal services reachable from the jshERP application server.
Affected Products
- jishenghua jshERP versions up to and including 3.6
- jshERP platformConfig Add Endpoint component
- PlatformConfigService.javainsertPlatformConfig function
Discovery Timeline
- 2026-06-08 - CVE-2026-11469 published to NVD
- 2026-06-08 - Last updated in NVD database
Technical Details for CVE-2026-11469
Vulnerability Analysis
The vulnerability is a server-side request forgery in the jshERP enterprise resource planning application. The insertPlatformConfig method in PlatformConfigService.java accepts a user-controlled platformValue parameter through the platform configuration add endpoint. The application uses this value when issuing server-originated network requests without validating that the destination is a legitimate, allow-listed target.
Because the request originates from the jshERP server, attackers can use it to reach internal hosts and services that are not directly reachable from the public network. This includes cloud metadata services, internal management interfaces, and other backend systems trusting the server's network position. The attack is remote and requires only authenticated access with high privileges, according to the CVSS 4.0 vector.
A public exploit reference has been published, and the maintainers had not responded to the upstream issue report at the time of publication.
Root Cause
The root cause is missing validation of the platformValue argument before it is consumed by a server-side HTTP client. The application does not enforce destination allow-listing, scheme restrictions, or DNS pinning to prevent requests to internal address ranges. This pattern matches CWE-918: Server-Side Request Forgery.
Attack Vector
An authenticated user with privileges to call the platformConfig Add Endpoint submits a crafted request containing a platformValue pointing to an attacker-chosen URL. The jshERP backend then issues an outbound request to that URL on behalf of the server. By targeting URLs such as internal IP ranges, cloud instance metadata endpoints, or service-discovery interfaces, an attacker can enumerate internal infrastructure and extract data returned in responses or error messages. See the VulDB Vulnerability Details for additional context.
Detection Methods for CVE-2026-11469
Indicators of Compromise
- Unexpected outbound HTTP or HTTPS connections originating from the jshERP application server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16.
- Application or web server logs showing requests to /platformConfig add endpoints with unusual platformValue URL parameters, including file://, http://169.254.169.254/, or localhost references.
- Spikes in failed or anomalous DNS lookups initiated by the jshERP Java process.
Detection Strategies
- Inspect HTTP access logs for POST requests to platform configuration endpoints containing URL-shaped values in platformValue.
- Correlate authenticated jshERP session activity with outbound network flows from the application host that target non-business destinations.
- Apply a Web Application Firewall (WAF) rule that flags request parameters carrying URL schemes pointing at private address space or cloud metadata IPs.
Monitoring Recommendations
- Egress filtering and logging on the jshERP application host, alerting on connections to internal management subnets.
- Continuous monitoring of the PlatformConfigService audit trail for new or modified platform configuration entries.
- Review of authentication logs for accounts with privileges to add platform configuration entries, focusing on uncommon source IPs or off-hours activity.
How to Mitigate CVE-2026-11469
Immediate Actions Required
- Restrict access to the jshERP platformConfig Add Endpoint to a minimal set of trusted administrative accounts.
- Place the jshERP server behind strict egress controls that only permit outbound traffic to required external destinations.
- Audit existing platform_config records for entries with URLs pointing at internal addresses or unexpected hosts.
Patch Information
No official patch has been published. According to the advisory, the project was informed early through an issue report but has not responded. Track the GitHub Project Repository and GitHub Issue Discussion for upstream remediation updates.
Workarounds
- Deploy a reverse proxy or WAF rule that rejects requests to platform configuration endpoints when platformValue contains private IP ranges, link-local addresses, or non-HTTP(S) schemes.
- Run the jshERP service account with network policies that block access to cloud metadata endpoints such as 169.254.169.254 and internal management interfaces.
- Apply application-layer input validation through a custom filter that enforces an allow-list of permitted external hostnames for platformValue.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
