SSRF Vulnerability in AutoBangumi Before 3.2.8

Detection Guidance

This vulnerability can be detected by attempting to send POST requests to the /api/v1/setup/test-downloader endpoint during the initial setup window of AutoBangumi versions before 3.2.8. By supplying arbitrary host values in these requests, you can observe if the server issues HTTP GET requests to internal or reserved IP addresses and returns connection-error messages that leak information.

A practical detection method involves using tools like curl or similar HTTP clients to send crafted POST requests to the vulnerable endpoint and analyzing the responses for leaked internal network information.

• Example curl command to test the vulnerability: curl -X POST http://<target-host>/api/v1/setup/test-downloader -d '{"host":"http://internal-ip-or-host"}' -H 'Content-Type: application/json'
• Monitor server responses for connection-error messages that indicate the server attempted to connect to the supplied internal host.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-59101 is a Server-Side Request Forgery (SSRF) vulnerability found in AutoBangumi versions before 3.2.8. It allows unauthenticated remote attackers to send arbitrary host values to an unprotected setup endpoint, specifically the POST /api/v1/setup/test-downloader endpoint during the initial setup phase.

When exploited, the server issues HTTP GET requests to internal or reserved IP addresses based on the attacker-supplied host values. The server then leaks information through connection-error messages that are echoed back in the response, enabling attackers to probe internal network services.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to probe and gather information about your internal network services without authentication. By exploiting the SSRF flaw, attackers can potentially discover internal IP addresses and services that are not meant to be publicly accessible.

Such information leakage can be a stepping stone for further attacks, including unauthorized access or exploitation of internal systems, increasing the risk to your network's security.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade AutoBangumi to version 3.2.8 or later, where this SSRF vulnerability has been fixed.

Until the upgrade can be applied, restrict access to the /api/v1/setup/test-downloader endpoint, especially during the initial setup phase, to trusted networks or authenticated users only.

Additionally, monitor and block suspicious POST requests targeting this endpoint that contain arbitrary host values to prevent exploitation.

Useful 0 Not Useful 0