CVE-2026-8320

Executive Summary

CVE-2026-8320 is a Server-Side Request Forgery (SSRF) vulnerability in the jshERP application by Jishenghua, affecting versions up to and including 3.6. The flaw resides in the updatePlatformConfigByKey endpoint, specifically within the getUserByWeixinCode function in UserService.java. An attacker can manipulate the weixinUrl argument to force the server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints, or other internal services. The vulnerability has a CVSS score of 4.7 (Medium) and a public proof-of-concept (PoC) is available. No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the jshERP Java/Spring Boot project. The risk is primarily to organizations that deploy jshERP as a self-hosted ERP solution. The lack of a vendor patch means users must rely on workarounds or custom fixes.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., internal service banners, cloud metadata).
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the public availability of an exploit and the potential for internal network pivoting elevate the risk for organizations with jshERP exposed to the internet.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the getUserByWeixinCode function within jshERP-boot/src/main/java/com/jsh/erp/service/UserService.java. The updatePlatformConfigByKey endpoint accepts a weixinUrl parameter. This parameter is used to construct an HTTP request to a WeChat API endpoint. However, the application does not validate or sanitize the URL, allowing an attacker to supply an arbitrary URL.

Attack Flow:

1. The attacker sends a POST request to the /updatePlatformConfigByKey endpoint with a crafted weixinUrl parameter.
2. The server uses this URL to make an HTTP request (likely via HttpURLConnection or a similar Java HTTP client).
3. The attacker can point the URL to internal resources (e.g., http://169.254.169.254/latest/meta-data/ for AWS cloud metadata) or other internal services.
4. The response from the internal resource is then reflected back to the attacker, potentially leaking sensitive information.

Root Cause: Lack of input validation and URL whitelisting. The application should restrict the weixinUrl to only trusted domains (e.g., api.weixin.qq.com).

Vulnerable vs. Patched Code

Vulnerable Code (jshERP <= 3.6):

// In UserService.java
public String getUserByWeixinCode(String weixinUrl) {
    // No validation of weixinUrl
    URL url = new URL(weixinUrl);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... read response and return
}

Patched Code (Hypothetical):

// In UserService.java
public String getUserByWeixinCode(String weixinUrl) {
    // Validate URL against a whitelist
    if (!weixinUrl.startsWith("https://api.weixin.qq.com/")) {
        throw new IllegalArgumentException("Invalid weixinUrl");
    }
    URL url = new URL(weixinUrl);
    HttpURLConnection connection = (HttpURLConnection) url.openConnection();
    // ... read response and return
}

Note: No official patch is available. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of jshERP (version <= 3.6) accessible over the network.
• No authentication required for the vulnerable endpoint.

Exploit Steps:

1. Identify the vulnerable endpoint: /updatePlatformConfigByKey
2. Craft a POST request with the weixinUrl parameter set to an internal resource.

Example Exploit (cURL):

curl -X POST "http://target:8080/updatePlatformConfigByKey" \
  -d "weixinUrl=http://169.254.169.254/latest/meta-data/"

Expected Output: The server will return the AWS metadata (or other internal resource content) in the HTTP response.

Advanced Exploitation:

• Use SSRF to scan internal ports (e.g., http://127.0.0.1:8080/admin).
• Access internal services like Redis, Memcached, or databases.
• Use file:// protocol to read local files (if supported by the HTTP client).

Blue Team

Detection:

• Monitor for POST requests to /updatePlatformConfigByKey with unusual weixinUrl parameters.
• Look for URLs containing internal IP addresses (e.g., 10., 172.16., 192.168., 127.0.0.1, 169.254.169.254).
• Alert on outbound HTTP requests from the jshERP server to unexpected destinations.

Mitigation (Immediate):

• Block the vulnerable endpoint at the web application firewall (WAF) or reverse proxy.
• Restrict outbound network access from the jshERP server to only necessary external services (e.g., api.weixin.qq.com).
• Apply a virtual patch by modifying the application code to validate the weixinUrl parameter.

Lab Setup:

1. Deploy jshERP 3.6 in a Docker container.
2. Expose port 8080.
3. Use a tool like Burp Suite or Postman to send the exploit request.
4. Set up a simple HTTP server (e.g., python -m http.server 9999) to simulate an internal service and verify the SSRF.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the jshERP server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.169.254).
• POST requests to /updatePlatformConfigByKey with a weixinUrl parameter containing non-standard domains or IPs.
• HTTP responses containing cloud metadata (e.g., ami-id, instance-id, region).

File IOCs:

• Log entries in jshERP logs showing requests to internal IPs.
• Modified configuration files (if the attacker persists changes).

Behavioral IOCs:

• Unusual outbound connections from the jshERP server to external IPs on non-standard ports.
• Repeated requests to the same endpoint with different weixinUrl values (scanning behavior).

Detection Engineering

YARA Rule

rule CVE_2026_8320_SSRF_jshERP {
    meta:
        description = "Detects SSRF exploitation attempts against jshERP CVE-2026-8320"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8320"
    strings:
        $s1 = "/updatePlatformConfigByKey" ascii wide nocase
        $s2 = "weixinUrl=" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "127.0.0.1" ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
        $s7 = "172.16." ascii wide nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2026-8320 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to jshERP's updatePlatformConfigByKey endpoint with internal IP addresses in the weixinUrl parameter.
author: Valters IT
date: 2026/01/01
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8320
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/updatePlatformConfigByKey'
        cs-uri-query|contains: 'weixinUrl='
    internal_ips:
        cs-uri-query|contains:
            - '169.254.169.254'
            - '127.0.0.1'
            - '10.'
            - '192.168.'
            - '172.16.'
    condition: selection and internal_ips
falsepositives:
    - Legitimate use of internal WeChat API proxies (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-8320 jshERP SSRF Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/updatePlatformConfigByKey"; http_uri; content:"weixinUrl="; http_client_body; pcre:"/weixinUrl=(https?:\/\/)?(169\.254\.169\.254|127\.0\.0\.1|10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If the updatePlatformConfigByKey functionality is not critical, block it at the web server or application firewall.
2. Network Segmentation: Ensure the jshERP server has restricted outbound access. Use a firewall to allow only necessary external connections (e.g., to api.weixin.qq.com).
3. Input Validation: Implement a whitelist of allowed URLs for the weixinUrl parameter. Only permit requests to https://api.weixin.qq.com/*.

Long-Term Fix:

• Apply a code patch to validate the weixinUrl parameter. The patch should:
  • Check that the URL starts with a trusted domain.
  • Block requests to private IP ranges (RFC 1918) and cloud metadata IPs.
  • Use a URL parser to prevent protocol smuggling (e.g., file://).

Vendor Communication:

• Since the vendor has not responded, consider forking the project and applying the fix yourself, or migrating to an alternative ERP solution.

Monitoring:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Monitor logs for unusual outbound HTTP requests from the jshERP server.

Valters IT
Securing Digital Frontiers