Description

A vulnerability was identified in PowerJob up to 5.1.2. Impacted is the function MuConnectionManager.getOrCreateConnection of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java of the component Transport Endpoint. The manipulation leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-31T08:17:03.700Z",
  "pubdate": "2026-08-31T08:17:03.700Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in PowerJob versions up to 5.1.2 within the MuConnectionManager.getOrCreateConnection function.\nThe vulnerability resides in the Transport Endpoint component, specifically within the TestController class, allowing unauthorized remote actors to manipulate the server into executing arbitrary outbound requests.\nBy targeting this endpoint, an attacker can bypass internal network security controls, probe internal services, or interact with restricted infrastructure that is not directly accessible from the public internet.\nThe risk is exacerbated by the availability of public exploit code, increasing the likelihood of weaponization.\nBecause the project maintainers have not yet responded to initial disclosures, the system remains in a vulnerable state, necessitating immediate proactive defensive measures by administrators to prevent unauthorized access and potential data exfiltration or internal service disruption.",
  "technicalDetails": "The vulnerability is located in the PowerJob server's 'TestController' component, specifically within the 'MuConnectionManager.getOrCreateConnection' function found in the file 'powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/TestController.java'.\nThe root cause of this SSRF vulnerability is the lack of proper validation or sanitization of user-supplied input provided to the connection management routine. The 'getOrCreateConnection' function processes input parameters that define the target destination for a network request, but fails to implement an allowlist or verify that the requested resource is legitimate and safe to access.\nThe exploitation flow begins when an unauthenticated or remote attacker sends a specially crafted HTTP request to the vulnerable endpoint. This request includes parameters that point the server towards internal network resources, such as local IP addresses (e.g., 127.0.0.1), private subnets, or sensitive internal management interfaces.\nWhen the server receives this payload, 'MuConnectionManager.getOrCreateConnection' initiates an outbound network request to the specified target before validating the destination. This forces the PowerJob server, which may hold elevated privileges or reside within a trusted network zone, to act as a proxy for the attacker's requests.\nBy manipulating the request, an attacker can bypass traditional firewalls or network segmentation that would normally prevent direct access to the internal network. The impact of such an attack includes, but is not limited to, unauthorized interaction with internal APIs, service discovery through port scanning of the server's environment, and potential interaction with services that rely on implicit trust based on originating IP address.\nBecause the vulnerability exists in a core transport component used by the server to handle connections, successful exploitation can lead to a significant breach of the server environment's security perimeter. The exploit's public availability suggests that the barrier to entry for potential adversaries is low, as the attack surface is exposed via remote access to the web controller."
}