Description

A server-side request forgery (SSRF) vulnerability exists in Foxit Workspace's file-upload functionality. Insufficient validation of user-supplied links may allow a remote attacker to induce the server to access internal resources and return their contents, potentially resulting in sensitive information disclosure and unauthorized access to internal services.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-06T05:18:20.677Z",
  "pubdate": "2026-11-06T05:18:20.677Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified within the file-upload functionality of Foxit Workspace.\nThis flaw originates from insufficient validation of user-supplied links, enabling an unauthenticated or remote attacker to force the application server to perform unauthorized HTTP requests.\nThe primary impact of this vulnerability is sensitive information disclosure, as the server may be leveraged to access internal network resources, retrieve sensitive metadata, or interact with restricted services that are otherwise inaccessible from the external perimeter.\nThe risk is categorized as high, as it grants attackers the ability to bypass network segmentation and interact with internal endpoints, potentially leading to further exploitation or unauthorized access to internal infrastructure components.\nSuccessful exploitation requires the attacker to submit crafted inputs into the file-upload mechanism, allowing them to manipulate the backend request structure. No specific prior authentication is strictly required if the upload functionality is publicly accessible.",
  "technicalDetails": "The vulnerability resides in the backend processing logic of the Foxit Workspace file-upload mechanism. The application fails to properly sanitize or restrict user-provided URLs when performing remote file fetches or processing upload requests.\nThe root cause is an improper trust boundary enforcement. The application utilizes a server-side component to fetch or validate remote resources based on user-supplied input without implementing an allow-list of domains or restricting access to internal network IP ranges (e.g., 127.0.0.1, 169.254.169.254, or RFC 1918 addresses).\nThe attack flow proceeds as follows: First, the attacker identifies the vulnerable file-upload endpoint which supports fetching files from external URIs. Second, the attacker crafts a malicious request by modifying the source URL parameter to point to internal resources, such as internal management interfaces, metadata services, or local filesystems via protocol handlers (e.g., file://, dict://, gopher://, or http://localhost:port).\nUpon receipt of the malicious request, the server executes a request to the attacker-specified destination. Because the request originates from the trusted server environment, internal security controls—such as firewalls or network access control lists—may be bypassed, as the internal service views the request as originating from a legitimate server-side process.\nThe application then returns the response from the internal resource back to the attacker, or confirms the success/failure of the connection based on the error messages rendered to the user. This feedback loop allows for port scanning or the exfiltration of sensitive configuration files, API credentials, and environment variables residing within the internal network segment.\nBy manipulating the request, an attacker can effectively pivot their footprint from the public-facing Foxit Workspace instance to the internal network fabric. This capability is particularly dangerous in cloud-hosted environments where metadata services (e.g., AWS/Azure/GCP instance metadata) can be queried to obtain IAM credentials or cloud configuration details. The lack of input validation ensures that the server acts as an open proxy, permitting the attacker to perform arbitrary interactions with any service capable of communicating over HTTP or other supported protocols."
}