CVE-2026-2945: JeecgBoot 3.9.0 SSRF Vulnerability

CVE-2026-2945 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in JeecgBoot version 3.9.0. This vulnerability affects the image upload functionality located at /sys/common/uploadImgByHttp, where improper validation of the fileUrl argument allows attackers to manipulate server-side requests. By exploiting this flaw, remote attackers can potentially access internal network resources, scan internal services, or retrieve sensitive information from systems that should not be externally accessible.

Critical Impact

Remote attackers can exploit this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server, potentially accessing internal services, cloud metadata endpoints, or performing port scanning of internal networks.

Affected Products

• JeecgBoot 3.9.0

Discovery Timeline

• 2026-02-22 - CVE-2026-2945 published to NVD
• 2026-02-23 - Last updated in NVD database

Technical Details for CVE-2026-2945

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The affected endpoint /sys/common/uploadImgByHttp is designed to fetch and upload images from external URLs. However, the application fails to properly validate and sanitize the fileUrl parameter, allowing attackers to specify arbitrary URLs including internal network addresses, localhost references, and cloud provider metadata endpoints.

The vulnerability can be exploited remotely over the network and requires low-privilege authentication to access the affected endpoint. When successfully exploited, an attacker can force the server to make HTTP requests to arbitrary destinations, potentially bypassing network segmentation and firewall controls.

Root Cause

The root cause of this vulnerability lies in insufficient input validation of the fileUrl parameter in the image upload functionality. The application accepts user-supplied URLs without implementing proper safeguards such as URL scheme whitelisting, domain validation, IP address blocking for internal ranges, or DNS rebinding protections. This allows malicious users to redirect server-side requests to unintended destinations.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the JeecgBoot application. An attacker can craft malicious requests to the /sys/common/uploadImgByHttp endpoint, providing a specially crafted fileUrl parameter pointing to internal resources. Common attack scenarios include:

The vulnerability in the fileUrl parameter allows attackers to target internal services by specifying URLs such as http://127.0.0.1/, http://localhost/, or internal IP ranges like http://192.168.x.x/. Attackers may also attempt to access cloud metadata services at addresses like http://169.254.169.254/ on AWS, GCP, or Azure environments to retrieve instance credentials and configuration data. The server processes these requests and returns the response content, effectively acting as a proxy for the attacker to reach otherwise inaccessible resources.

Detection Methods for CVE-2026-2945

Indicators of Compromise

• Unusual outbound HTTP requests from the JeecgBoot server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) or localhost
• Access logs showing repeated requests to /sys/common/uploadImgByHttp with suspicious fileUrl parameters containing internal addresses or cloud metadata endpoints
• Network traffic from the application server attempting to connect to cloud provider metadata services (169.254.169.254)

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing internal IP addresses or localhost references in the fileUrl parameter
• Monitor application logs for unusual patterns in the /sys/common/uploadImgByHttp endpoint, particularly requests with non-standard URL schemes or internal hostnames
• Deploy network monitoring to detect unexpected outbound connections from the JeecgBoot server to internal services or metadata endpoints

Monitoring Recommendations

• Enable detailed logging for all requests to the /sys/common/uploadImgByHttp endpoint including full URL parameters
• Configure network-level monitoring to alert on outbound connections from the application server to RFC 1918 private address ranges
• Implement egress filtering and monitor for any bypassed connections to internal or cloud infrastructure services

How to Mitigate CVE-2026-2945

Immediate Actions Required

• Restrict access to the /sys/common/uploadImgByHttp endpoint to only trusted users or disable the functionality if not required
• Implement network egress controls to prevent the JeecgBoot server from making requests to internal networks and cloud metadata endpoints
• Deploy a web application firewall with SSRF protection rules to filter malicious fileUrl parameters

Patch Information

As of the last update on 2026-02-23, the vendor (JeecgBoot) has not responded to disclosure attempts and no official patch has been released. Organizations should monitor the official JeecgBoot repository and security advisories for patch availability. Additional technical details are available through the VulDB entry and the Yuque Document Analysis.

Workarounds

• Implement URL validation to restrict fileUrl to only allow HTTPS URLs from a whitelist of trusted external domains
• Block requests where the fileUrl parameter resolves to private IP ranges, loopback addresses, or link-local addresses at the application or network level
• Consider disabling the uploadImgByHttp functionality entirely if remote image fetching is not a business requirement

# Example nginx configuration to block access to vulnerable endpoint
location /sys/common/uploadImgByHttp {
    # Block access to vulnerable SSRF endpoint until patched
    deny all;
    return 403;
}