CVE-2026-6625
Server-Side Request Forgery in Mogu Blog Picture Service
Publication date: 2026-04-20
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| moxi624 | mogu_blog | to 5.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the moxi624 Mogu Blog v2 software, specifically in the function LocalFileServiceImpl.uploadPictureByUrl within the Picture Storage Service component. It allows an attacker to perform server-side request forgery (SSRF), meaning the attacker can make the server send requests to unintended locations. The attack can be initiated remotely, and the vulnerability has been publicly disclosed.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to manipulate the server to send unauthorized requests, potentially accessing internal systems or sensitive data that should not be exposed. This can lead to information disclosure, unauthorized actions, or further exploitation of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability enables attackers to perform server-side request forgery (SSRF) that can lead to unauthorized access to sensitive data, including internal service data, system files, and cloud metadata containing IAM credentials.
Such unauthorized data access and potential data breaches could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and disclosure.
Specifically, the exposure of sensitive files and cloud credentials could lead to violations of confidentiality and data integrity requirements mandated by these standards.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for unusual server-side HTTP requests initiated by the Picture Storage Service, especially requests to internal IP addresses, cloud metadata endpoints, or local file URLs.
Detection can involve inspecting logs for outbound HTTP requests made by the application to suspicious or internal addresses such as 169.254.169.254 (cloud metadata), localhost, or file:// URLs.
Suggested commands include using network monitoring tools or command-line utilities to detect such requests, for example:
- Use tcpdump or tshark to capture outbound HTTP requests from the server: tcpdump -i eth0 'tcp dst port 80 or 443'
- Use curl or wget to test if the server can access internal metadata endpoints: curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
- Check application logs for URLs passed to the Picture Storage Service, looking for suspicious or unexpected URLs.
- Use netstat or ss to monitor active connections and identify unexpected outbound connections.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include validating and whitelisting avatar URLs before the application fetches them.
Restrict protocols to safe ones such as only allowing http and https, and block unsupported or dangerous protocols like file://.
Implement IP address validation to block requests to internal IP ranges and cloud metadata IP addresses.
Sanitize and verify OAuth provider responses to ensure avatar URLs are legitimate and safe.
Employ network-level protections such as firewall rules to prevent the server from making unauthorized requests to internal services or cloud metadata endpoints.