Executive Summary

This vulnerability is a stored Server-Side Request Forgery (SSRF) found in jishenghua jshERP versions 3.6 and earlier. It occurs in the insertPlatformConfig function of the platformConfig Add Endpoint, where an attacker with administrative privileges can inject a malicious URL by setting the platformKey to "weixinUrl" and platformValue to a target URL.

The malicious URL is stored in the jsh_platform_config database table. Later, when the system calls WeChat-related functions such as getAccessToken, getUserByWeixinCode, or weixinBind, it retrieves this stored URL and uses it in an HTTP GET request without proper validation. This allows attackers to make arbitrary outbound HTTP requests from the server to internal services, cloud metadata endpoints, or other restricted network locations.

The root cause is insufficient input validation during configuration storage and retrieval, enabling the execution of attacker-controlled URLs when WeChat API functions are triggered.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to make arbitrary HTTP GET requests from the vulnerable server to internal or external systems. This can lead to several impacts:

• Bypass of network restrictions or firewalls by making requests to internal services that are not normally accessible externally.
• Access to sensitive internal resources such as cloud metadata endpoints, which may expose credentials or configuration data.
• Potential information disclosure or further exploitation by leveraging the server as a proxy to reach otherwise inaccessible systems.
• Compromise of system integrity or confidentiality depending on what internal services are accessible via the SSRF.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the /platformConfig/add endpoint, especially those setting the platformKey to "weixinUrl" with unusual or unexpected platformValue URLs.

You can check the jsh_platform_config database table for any stored URLs that look suspicious or unexpected, as these URLs may be used to trigger SSRF.

Network monitoring tools can be used to detect unexpected outbound HTTP GET requests originating from the server to internal services or cloud metadata endpoints, which may indicate exploitation attempts.

• Use curl or similar tools to simulate the POST request and check if the system accepts malicious URLs: curl -X POST -d 'platformKey=weixinUrl&platformValue=http://malicious.example.com' http://target-server/platformConfig/add
• Query the database to find suspicious entries: SELECT * FROM jsh_platform_config WHERE platformKey = 'weixinUrl';
• Monitor outbound HTTP requests from the server using tools like tcpdump or Wireshark to detect unusual HTTP GET requests to internal or external unexpected destinations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the /platformConfig/add endpoint to trusted administrative users only, as the vulnerability requires administrative privileges to exploit.

Validate and sanitize all inputs to the platformValue parameter to prevent injection of malicious URLs.

Review and remove any suspicious or untrusted URLs stored in the jsh_platform_config database table, especially those associated with the platformKey "weixinUrl".

Implement network-level controls to restrict outbound HTTP requests from the server to only trusted destinations, preventing SSRF exploitation.

Monitor logs and network traffic for signs of exploitation attempts and respond accordingly.

Since the project has not yet responded with a patch, consider applying custom input validation or temporarily disabling the vulnerable functionality if possible.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker with administrative privileges to perform server-side request forgery (SSRF) by injecting malicious URLs into the system configuration. This can lead to unauthorized outbound HTTP requests to internal services or cloud metadata endpoints, potentially exposing sensitive internal information or enabling further attacks.

Such unauthorized access and potential data exposure could impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive data, as well as ensuring system integrity and preventing unauthorized access.

However, the provided information does not explicitly detail the direct compliance impact or specific regulatory breaches caused by this vulnerability.

Useful 0 Not Useful 0