Description

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.9.8-hotfix1 and 0.9.8 is sufficient to resolve this issue. The patch is named a599007325efe780a21b3537ecce3ca25635c926. It is suggested to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-16T03:16:49.333Z",
  "pubdate": "2026-08-16T03:16:49.333Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in OpenBoxes up to version 0.9.7, specifically within the Product Upload Endpoint handled by the Upload function inside grails-app/controllers/org/pih/warehouse/product/ProductController.groovy. This flaw arises from improper validation and handling of user-supplied input passed via the params.url argument. Exploitation of this vulnerability allows a remote, unauthenticated attacker to induce the affected server into dispatching arbitrary outbound HTTP requests to internal or external resources. The realization of this SSRF vector poses severe risk implications, potentially granting adversaries unauthorized access to internal network services, cloud metadata endpoints, and sensitive data residing behind corporate firewalls. Given that public exploit material exists in the wild, the threat level is elevated, necessitating immediate remediation to prevent potential compromise of the underlying infrastructure and host systems.",
  "technicalDetails": "The vulnerability resides in the Product Upload Endpoint of OpenBoxes, specifically inside the Upload function located in the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy. The root cause of the flaw is the insecure processing of network-related parameters without adequate input sanitization, schema validation, or domain whitelisting. Specifically, the parameter params.url is processed directly by the application backend to retrieve remote resources or data streams without restricting destination IP addresses or URL schemes.\nThe attack flow initiates when a remote adversary interacts with the vulnerable product upload functionality. By manipulating the params.url argument, the attacker can supply malicious Uniform Resource Identifiers pointing to arbitrary destinations. When the Upload function processes this input, the underlying server executes an outbound request directed toward the attacker-specified target. Because the application logic fails to restrict or validate the network boundaries of the target URL, the server acts as an inadvertent proxy.\nNetwork exposure is fully remote, enabling external threat actors to target instances accessible via the web interface. Depending on the exact deployment configuration, the authentication and privilege requirements to reach the vulnerable endpoint depend on whether public access is permitted to the product upload controller. The behavior of the payload involves forcing the server to query arbitrary intranet services, localhost endpoints, or external servers, thereby leaking internal network topology, bypassing perimeter access controls, or interacting with internal APIs.\nThe post-exploitation impact of this Server-Side Request Forgery vulnerability encompasses unauthorized data exfiltration, internal port scanning, and potential remote code execution if vulnerable internal services lack robust authentication. Adversaries can leverage the server's privileged network position to access restricted resources that are otherwise shielded from direct external access."
}