Description

The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery (SSRF).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-26T23:17:19.033Z",
  "pubdate": "2026-08-26T23:17:19.033Z",
  "executiveSummary": "The JetLinks Community edition version 2.11 contains a Server-Side Request Forgery (SSRF) vulnerability within its device metadata import functionality.\nThis vulnerability resides in the /device/instance/{productId}/property-metadata/import endpoint, which fails to properly validate or sanitize user-supplied URLs during the import process.\nBy manipulating these input parameters, an authenticated attacker can force the application server to perform arbitrary HTTP requests to internal or external resources.\nThe security implications include the potential for unauthorized access to internal network services, discovery of local infrastructure, bypassing perimeter firewalls, and potentially exfiltrating sensitive internal data.\nSuccessful exploitation requires the attacker to have sufficient privileges to access the device instance management interface.\nThe vulnerability highlights a critical failure in server-side input validation when handling remote resource resolution, exposing the underlying infrastructure to reconnaissance and post-exploitation threats.",
  "technicalDetails": "The vulnerability exists within the /device/instance/{productId}/property-metadata/import endpoint of the JetLinks Community 2.11 platform. The core issue stems from the application's implementation of a metadata import mechanism that permits the specification of a remote resource location via an input parameter. The backend service fails to enforce robust allow-listing or URI sanitization on this input before passing it to the underlying HTTP client for file retrieval.\nThe attack flow initiates when an authenticated user sends a crafted request to the vulnerable endpoint. By supplying a malicious URL or an internal network address (such as 127.0.0.1 or an internal metadata repository IP) as part of the metadata import payload, the attacker triggers the server-side logic to attempt a connection to the specified target. Because the application processes this request on behalf of the user without verifying the destination, it effectively acts as a proxy for the attacker's activities.\nThis SSRF allows an attacker to bypass traditional network boundary controls. From the perspective of internal network services, the connection appears to originate from the JetLinks server itself, which is often trusted by internal APIs, databases, or management consoles that lack additional authentication layers. The attacker can perform port scanning on internal infrastructure, probe sensitive internal HTTP services, and gain information about the internal network topology.\nBeyond reconnaissance, the vulnerability can be leveraged to retrieve sensitive documentation, environmental configuration files, or other data exposed via internal endpoints. Furthermore, in environments where the metadata import service has elevated network privileges or integrated credentials for downstream systems, the impact could extend to unauthorized data manipulation or service disruption. The lack of strict protocol handling or destination host verification ensures that the server blindly follows redirects or attempts connections to arbitrary ports, significantly broadening the attack surface available to an authenticated adversary."
}