CVE-2026-4200 Overview
A Server-Side Request Forgery (SSRF) vulnerability has been discovered in glowxq glowxq-oj, an online judge platform. This security flaw affects the uploadTestcaseZipUrl function within the file business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java. The vulnerability allows remote attackers to manipulate server-side requests, potentially enabling them to access internal resources, bypass security controls, and interact with backend services that should not be accessible from external networks.
Critical Impact
This SSRF vulnerability can be exploited remotely without authentication, allowing attackers to forge requests from the vulnerable server to internal systems, potentially exposing sensitive data or enabling further attacks on internal infrastructure.
Affected Products
- glowxq glowxq-oj up to commit 6f7c723090472057252040fd2bbbdaa1b5ed2393
Discovery Timeline
- 2026-03-16 - CVE CVE-2026-4200 published to NVD
- 2026-03-16 - Last updated in NVD database
Technical Details for CVE-2026-4200
Vulnerability Analysis
This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The flaw exists in the uploadTestcaseZipUrl function of the ProblemCaseController.java file, which is responsible for handling URL-based testcase uploads in the online judge platform.
The root cause is insufficient validation of user-supplied URLs before the server makes requests to fetch external resources. When a user provides a URL for uploading testcase files, the application makes server-side requests to retrieve the content without properly validating whether the destination is a trusted external resource or an internal service.
The exploit has been publicly released, increasing the risk of active exploitation. The vendor was contacted about this vulnerability but did not respond to the disclosure.
Root Cause
The vulnerability stems from improper input validation in the URL handling logic within the uploadTestcaseZipUrl function. The application fails to implement proper URL scheme validation, hostname allowlisting, or restrictions on internal network access. This allows attackers to craft malicious URLs that cause the server to make requests to arbitrary destinations, including internal services, cloud metadata endpoints, and other protected resources.
Attack Vector
An attacker can exploit this vulnerability remotely over the network without requiring authentication. The attack involves submitting a crafted URL to the uploadTestcaseZipUrl endpoint that points to internal resources instead of legitimate external files. When the server processes this request, it will fetch content from the attacker-specified location, effectively allowing the attacker to:
- Scan internal network infrastructure
- Access cloud provider metadata services (e.g., AWS IMDSv1, Azure IMDS)
- Retrieve sensitive configuration data from internal endpoints
- Bypass firewall restrictions by using the server as a proxy
- Interact with internal APIs and services
The vulnerability details and exploitation methodology have been documented in the Feishu Document Share. Additional technical context is available through VulDB #351112.
Detection Methods for CVE-2026-4200
Indicators of Compromise
- Outbound HTTP/HTTPS requests from the application server to internal IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x)
- Requests to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal
- Unusual access patterns to the uploadTestcaseZipUrl endpoint with non-standard URL schemes
- Server logs showing requests to localhost or loopback addresses (127.0.0.1, ::1)
Detection Strategies
- Implement network monitoring to detect outbound connections from the application server to internal IP address ranges
- Enable detailed logging on the ProblemCaseController endpoints and monitor for suspicious URL patterns
- Deploy web application firewall (WAF) rules to detect and block SSRF attack patterns in request parameters
- Monitor DNS queries from the application server for resolution of internal hostnames
Monitoring Recommendations
- Configure alerts for any outbound connections to RFC 1918 private address spaces from the application tier
- Implement anomaly detection for the uploadTestcaseZipUrl endpoint to identify unusual request volumes or patterns
- Set up monitoring for cloud metadata service access attempts from application servers
- Review application logs regularly for URL manipulation attempts containing internal addresses or uncommon protocols
How to Mitigate CVE-2026-4200
Immediate Actions Required
- Restrict network egress from the application server to only necessary external destinations using firewall rules
- Implement URL validation that blocks private IP ranges, localhost, and internal hostnames
- Disable the uploadTestcaseZipUrl functionality if not critical to operations until a patch is available
- Add authentication requirements to the vulnerable endpoint if currently accessible anonymously
Patch Information
This product uses continuous delivery with rolling releases. No specific version details for affected or updated releases are available. The vendor was contacted about this vulnerability but did not respond. Users should monitor the project repository for updates to the ProblemCaseController.java file that address URL validation. Check VulDB Submit #770476 for the latest status on this vulnerability.
Workarounds
- Implement a URL allowlist that restricts the uploadTestcaseZipUrl function to only fetch from trusted domains
- Deploy a web proxy or gateway that validates all outbound HTTP requests from the application server
- Configure network-level controls to block outbound connections to internal IP ranges from the application server
- Consider using a dedicated service account with minimal network privileges for running the application
# Example iptables rules to restrict outbound SSRF attempts
# Block outbound to private IP ranges from the application server
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
