# [Security] Second-Order SSRF in jeecboot_JeecBoot #9553 ## 漏洞概述 在 `jeecboot_JeecBoot` 的公告文件下载功能中存在**二次服务器端请求伪造（SSRF）**漏洞。攻击者可通过 `POST /sys/announcement/add` 接口，在 `files` 字段中注入恶意 HTTP URL。当用户或管理员随后通过 `GET /sys/announcement/downloadFiles` 触发下载时，服务器会未经 SSRF 防护地发起 HTTP 请求，从而扫描内网、访问本地服务或获取云元数据等敏感信息。 ## 影响范围 - **受影响版本**： add(@RequestBody SysAnnouncement sysAnnouncement) { Result result = new Result(); // 代码省略... String title = XssUtils.scriptFilter(sysAnnouncement.getTitle()); sysAnnouncement.setTitle(title); // 代码省略... sysAnnouncementService.saveAnnouncement(sysAnnouncement); result.success("添加成功!"); return result; } ``` ### 恶意载荷示例 ```json { "title": "Important Announcement", "attachment": "Please review attachments", "files": "http://169.254.169.254/latest/meta-data/iam/security-credentials/http://192.168.1.1/admin" } ``` ### 触发阶段（SysAnnouncementServiceImpl.java） ```java SysAnnouncement sysAnnouncement = this.baseMapper.selectById(id); // line 290 String[] fileUrls = sysAnnouncement.getFiles().split(","); // line 300 for (int i = 0; i < fileUrls.length; i++) { String fileUrl = fileUrls[i].trim(); SurFileTypeFilter.checkPathTraversalBatch(sysAnnouncement.getFiles()); // line 308 FileDownloadUtils.downloadSingleFile(fileUrl, filename, uploadUrl, zoom); // line 313 } ``` ### 利用阶段（FileDownloadUtils.java） ```java public static InputStream getDownInputStream(String fileUrl, String uploadUrl) { try { // HTTP URL: NO SSRF PROTECTION if (convertUtils.isUrl(fileUrl) && fileUrl.startsWith(CommonConstant.STR_HTTP)) { URL url = new URL(fileUrl); HttpsURLConnection connection = (HttpsURLConnection) url.openConnection(); connection.setConnectTimeout(5000); connection.setReadTimeout(30000); return connection.getInputStream(); // <-- SSRF HERE } else { // Local files: Protected by SurFileTypeFilter String downloadFilePath = uploadUrl + File.separator + fileUrl; SurFileTypeFilter.checkDownloadFileType(downloadFilePath); return new BufferedInputStream(new FileInputStream(downloadFilePath)); } } catch (IOException e) { return null; } } ```