CVE-2026-4200: glowxq-oj SSRF Vulnerability

CVE-2026-4200 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been discovered in glowxq glowxq-oj, an online judge platform. This security flaw affects the uploadTestcaseZipUrl function within the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. The vulnerability allows remote attackers to manipulate server-side requests, potentially enabling them to access internal resources, bypass security controls, and interact with backend services that should not be accessible from external networks.

Critical Impact
This SSRF vulnerability can be exploited remotely without authentication, allowing attackers to forge requests from the vulnerable server to internal systems, potentially exposing sensitive data or enabling further attacks on internal infrastructure.

Affected Products

glowxq glowxq-oj up to commit 6f7c723090472057252040fd2bbbdaa1b5ed2393

Discovery Timeline

2026-03-16 - CVE CVE-2026-4200 published to NVD
2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-4200

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw exists in the uploadTestcaseZipUrl function of the ProblemCaseController.java file, which is responsible for handling URL-based testcase uploads in the online judge platform.

The root cause is insufficient validation of user-supplied URLs before the server makes requests to fetch external resources. When a user provides a URL for uploading testcase files, the application makes server-side requests to retrieve the content without properly validating whether the destination is a trusted external resource or an internal service.

The exploit has been publicly released, increasing the risk of active exploitation. The vendor was contacted about this vulnerability but did not respond to the disclosure.

Root Cause

The vulnerability stems from improper input validation in the URL handling logic within the uploadTestcaseZipUrl function. The application fails to implement proper URL scheme validation, hostname allowlisting, or restrictions on internal network access. This allows attackers to craft malicious URLs that cause the server to make requests to arbitrary destinations, including internal services, cloud metadata endpoints, and other protected resources.

Attack Vector

An attacker can exploit this vulnerability remotely over the network without requiring authentication. The attack involves submitting a crafted URL to the uploadTestcaseZipUrl endpoint that points to internal resources instead of legitimate external files. When the server processes this request, it will fetch content from the attacker-specified location, effectively allowing the attacker to:

Scan internal network infrastructure
Access cloud provider metadata services (e.g., AWS IMDSv1, Azure IMDS)
Retrieve sensitive configuration data from internal endpoints
Bypass firewall restrictions by using the server as a proxy
Interact with internal APIs and services

The vulnerability details and exploitation methodology have been documented in the Feishu Document Share. Additional technical context is available through VulDB #351112.

Detection Methods for CVE-2026-4200

Indicators of Compromise

Outbound HTTP/HTTPS requests from the application server to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
Unusual access patterns to the uploadTestcaseZipUrl endpoint with non-standard URL schemes
Server logs showing requests to localhost or loopback addresses (127.0.0.1, ::1)

Detection Strategies

Implement network monitoring to detect outbound connections from the application server to internal IP address ranges
Enable detailed logging on the ProblemCaseController endpoints and monitor for suspicious URL patterns
Deploy web application firewall (WAF) rules to detect and block SSRF attack patterns in request parameters
Monitor DNS queries from the application server for resolution of internal hostnames

Monitoring Recommendations

Configure alerts for any outbound connections to RFC 1918 private address spaces from the application tier
Implement anomaly detection for the uploadTestcaseZipUrl endpoint to identify unusual request volumes or patterns
Set up monitoring for cloud metadata service access attempts from application servers
Review application logs regularly for URL manipulation attempts containing internal addresses or uncommon protocols

How to Mitigate CVE-2026-4200

Immediate Actions Required

Restrict network egress from the application server to only necessary external destinations using firewall rules
Implement URL validation that blocks private IP ranges, localhost, and internal hostnames
Disable the uploadTestcaseZipUrl functionality if not critical to operations until a patch is available
Add authentication requirements to the vulnerable endpoint if currently accessible anonymously

Patch Information

This product uses continuous delivery with rolling releases. No specific version details for affected or updated releases are available. The vendor was contacted about this vulnerability but did not respond. Users should monitor the project repository for updates to the ProblemCaseController.java file that address URL validation. Check VulDB Submit #770476 for the latest status on this vulnerability.

Workarounds

Implement a URL allowlist that restricts the uploadTestcaseZipUrl function to only fetch from trusted domains
Deploy a web proxy or gateway that validates all outbound HTTP requests from the application server
Configure network-level controls to block outbound connections to internal IP ranges from the application server
Consider using a dedicated service account with minimal network privileges for running the application

bash

# Example iptables rules to restrict outbound SSRF attempts
# Block outbound to private IP ranges from the application server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP