Description

Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-26T23:17:18.657Z",
  "pubdate": "2026-08-26T23:17:18.657Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in Zyplayer-Doc versions 1.0.0 and earlier. The flaw resides within the WikiPageWebService.download() function, which fails to adequately sanitize user-supplied input used in network requests.\nThis vulnerability allows an unauthenticated or authenticated attacker to force the application server to initiate arbitrary HTTP requests to internal or external resources. By manipulating the input parameters of the affected function, an attacker can bypass firewall protections, perform internal network scanning, interact with internal services that are not exposed to the public internet (such as metadata services or internal APIs), or conduct unauthorized data exfiltration.\nThe risk is critical due to the potential for attackers to gain visibility into the internal network topology and exploit services that rely on IP-based trust. No specific exploitation prerequisites are mentioned beyond access to the affected endpoint. Organizations utilizing Zyplayer-Doc must restrict network egress from the application server and implement strict input validation to mitigate the risk of unauthorized server-side requests.",
  "technicalDetails": "The vulnerability is located in the WikiPageWebService.download() function within Zyplayer-Doc versions 1.0.0 and below. The root cause is the lack of proper validation and sanitization of a URL or file path parameter passed to the function before it is utilized by the server to perform a fetch operation.\nThe exploitation mechanism relies on the server-side processing of untrusted input. When a request is crafted to invoke the WikiPageWebService.download() function, the application acts as a proxy, executing an outbound request based on the user-provided input. Because the server does not enforce an allowlist of permitted hosts or protocols, an attacker can specify arbitrary target URIs. This facilitates the SSRF attack pattern, where the server is leveraged to perform requests on behalf of the attacker.\nThe attack flow proceeds as follows: First, the attacker identifies the endpoint associated with the WikiPageWebService.download() function. Second, the attacker constructs a malicious request containing the target URI in the vulnerable parameter. This URI may point to an internal resource (e.g., http://127.0.0.1:8080/admin or http://169.254.169.254/latest/meta-data/ for cloud instances) or an external destination. Third, the application processes this input and initiates a backend HTTP request to the specified target. Finally, the server may reflect the content of the target response back to the user, or the attacker may rely on out-of-band communication or timing side-channels to confirm the success of the request.\nThe component affected is the backend service handling WikiPage operations. The vulnerability is particularly dangerous in cloud-hosted environments where internal metadata services are reachable via SSRF, potentially leading to the disclosure of sensitive credentials or configuration data. Furthermore, the ability to interact with the internal network allows the attacker to bypass perimeter security controls, potentially discovering and exploiting vulnerabilities in backend systems that are considered 'trusted' by the Zyplayer-Doc application. The lack of network egress filtering on the application server exacerbates the impact, as it permits the attacker to scan the internal network range efficiently and execute requests against arbitrary internal ports."
}