Description

A vulnerability has been found in yaojingang GEOFlow up to 2.1.0. Impacted is the function DistributionController.isValidHttpEndpoint of the file app/Services/GeoFlow/GenericHttpEndpointResolver.php. Such manipulation of the argument endpoint_url leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.1.1 is recommended to address this issue. The name of the patch is 67abfd864a15d169a78429f3290c91cb3b93e849. It is advisable to upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-31T09:17:04.940Z",
  "pubdate": "2026-08-31T09:17:04.940Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in yaojingang GEOFlow versions up to 2.1.0.\nThe vulnerability resides within the DistributionController.isValidHttpEndpoint function in app/Services/GeoFlow/GenericHttpEndpointResolver.php, where improper validation of the endpoint_url argument allows unauthorized requests.\nSuccessful exploitation enables an attacker to force the server to perform arbitrary HTTP requests to internal or external systems, bypassing perimeter security controls.\nThe flaw can be triggered remotely without specific authentication requirements, posing a significant risk to the integrity of internal network resources and service confidentiality.\nThe vulnerability is currently publicly disclosed with active exploit potential, necessitating immediate remediation to maintain the security posture of the deployment.",
  "technicalDetails": "The root cause of this SSRF vulnerability is the insufficient sanitization and validation of the endpoint_url parameter within the DistributionController.isValidHttpEndpoint function located in app/Services/GeoFlow/GenericHttpEndpointResolver.php.\nIn versions up to 2.1.0, the application logic fails to implement robust allow-listing or URI scheme validation before processing the user-supplied URL. This allows an attacker to manipulate the endpoint_url to point towards arbitrary destinations, including local loopback addresses (127.0.0.1), internal metadata services, or private network endpoints that are normally inaccessible from the public internet.\nThe attack flow initiates when an unauthenticated remote adversary submits a crafted request containing a malicious URL payload to the vulnerable endpoint. Upon processing the request, the GenericHttpEndpointResolver.php component utilizes the attacker-controlled input to perform a server-side request. Because the validation logic within isValidHttpEndpoint is inadequate, the server executes the request on behalf of the attacker.\nThe potential post-exploitation impact includes unauthorized interaction with internal services (such as cloud metadata instances, internal APIs, or databases), information disclosure through the retrieval of sensitive internal response data, and the potential for port scanning of the internal infrastructure. By weaponizing the server as a proxy, the attacker can effectively bypass firewall restrictions and access non-public resources behind the network perimeter.\nThis vulnerability highlights a failure in input boundary control, specifically regarding the trust placed in user-supplied URL parameters. Exploitation is facilitated because the server performs the request resolution without verifying that the destination conforms to expected network boundaries or defined service policies.\nThe disclosed exploit vector emphasizes that the vulnerability is reachable over a network without requirement for prior user authentication or elevated privileges, making it a critical entry point for lateral movement within an infrastructure hosted on the affected software."
}