Description

A server-side request forgery (SSRF) vulnerability exists in an undocumented API endpoint of Foxit Workspace due to insufficient validation of user-supplied URL and network parameters. A remote attacker could exploit this issue to induce the server to send requests to arbitrary internal or external resources, potentially enabling unauthorized access to internal services, network reconnaissance, and sensitive information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.7",
  "pubDate": "2026-11-06T05:18:20.970Z",
  "pubdate": "2026-11-06T05:18:20.970Z",
  "executiveSummary": "An undocumented API endpoint within Foxit Workspace is susceptible to Server-Side Request Forgery (SSRF) due to inadequate validation of user-supplied URL and network parameters.\nThis vulnerability enables remote attackers to manipulate the server into initiating unauthorized outbound HTTP/network requests toward arbitrary internal infrastructure or external entities.\nThe primary risk involves the compromise of internal network segmentation, as the server acts as a proxy for malicious traffic, potentially bypassing perimeter firewalls.\nThe vulnerability does not explicitly require prior authentication to the affected endpoint, as it resides within an undocumented, potentially exposed, API surface.\nImpacts include network reconnaissance, unauthorized interaction with internal microservices, and potential exfiltration of sensitive information or metadata that would otherwise be inaccessible from the public internet.",
  "technicalDetails": "The root cause of this vulnerability is the improper implementation of input validation filters on URL and network-related parameters within an undocumented Foxit Workspace API endpoint.\nThe application logic fails to perform sufficient allow-listing or URI scheme validation before passing these user-controlled inputs to the backend request-processing libraries.\nExploitation follows a predictable path: an attacker identifies the undocumented endpoint and injects a crafted URL into the vulnerable parameter. When the application server receives this request, it attempts to resolve the URL, effectively performing a request on behalf of the attacker.\nBecause the server originates these requests, it possesses an 'internal' perspective of the network. The attacker can target internal IP addresses (e.g., 127.0.0.1 or 192.168.x.x) and non-standard ports, bypassing traditional perimeter defenses that govern external-to-internal traffic flow.\nThe attack flow allows for several post-exploitation vectors, including: 1) Port scanning and service discovery to map the internal network topology; 2) Interaction with internal REST APIs or administrative interfaces that lack secondary authentication; 3) Exploitation of local services that trust traffic originating from the local host (localhost bypass); and 4) Extraction of cloud environment metadata (such as AWS/Azure instance metadata services) if the host is running in a cloud-native environment.\nThe vulnerability is critical due to the lack of adequate input sanitization and the implicit trust often granted to internal service-to-service communication.\nBecause the endpoint is undocumented, it may lack the standard security wrappers, API gateways, or rate-limiting protections applied to the primary application endpoints, increasing the ease of exploitation.\nSuccessful exploitation allows for the exfiltration of system-level responses, sensitive configuration data, or internal headers, providing the attacker with sufficient information to conduct further lateral movement or privilege escalation within the network architecture."
}