Zplayer-Doc SSRF Vulnerability Analysis and PoC

Zplayer-Doc SSRF Vulnerability Key Information Summary Vulnerability Overview The method in uses Jsoup to parse HTML content, extracts URLs from tags, and downloads them via . Since no validation is performed on the URL, a Server-Side Request Forgery (SSRF) vulnerability exists. Scope of Impact Affected Versions: Zplayer-Doc < 1.0.0 Exploitation Conditions: - Having edit or download permissions for authenticated pages - Or, via the Open API with zero authentication, enabling access to any UUID Remediation Add validation logic to the URL extracted by . Restrict the range of accessible domains/IPs to prevent arbitrary URLs from being requested by the server. POC / Exploitation Code SSRF POC (Create Page): Vulnerable Code (WikiPageWebService.java): ```java if (ObjectUtil.isAnyEmpty(wikiPage.getId(), currentuser.getId(), wikiPageId.getRecordId())) { return R.failed("Current user does not have permission to view this page"); } String wikiPagePath = new FileUtil(wikiPageId.get("lang").replaceAll("\\\\", "/")+"/wiki/"; try { String filename = wikiPageId.get("lang").replaceAll("\\\\", "/")+"/wiki/"; String document = wikiPageId.get("lang").replaceAll("\\\\", "/")+"/wiki/"; Document document = Jsoup.parse(document); Elements images = document.select("img"); for (Element img : images) { String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { try { wikiPageService = wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.writeUtf8String(document, wikiPagePath + filename); wikiPageService.download(src); String src = img.attr("src"); if (ObjectUtil.isNotEmpty(src) && !src.startsWith("data:")) { wikiPageService.download(src); String originName = wikiPageService.download(src); String filename = wikiPageService.download(src); FileUtil.writeUtf8String(document, wikiPagePath + filename); FileUtil.w

Goal Reached Thanks to every supporter — we hit 100%!

Zplayer-Doc SSRF Vulnerability Analysis and PoC

More from this source