Description

A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-07T06:17:23.580Z",
  "pubdate": "2026-09-07T06:17:23.580Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the projeto-siga application, specifically within the HTML-to-PDF generation component.\nThe vulnerability allows an unauthenticated remote attacker to manipulate the 'html' argument to force the server to initiate arbitrary HTTP requests to internal or external resources.\nThis flaw resides in the 'DownloadExterno.getUrl' function within 'sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java'.\nSuccessful exploitation could lead to unauthorized access to internal network services, information disclosure, or the potential for further attacks against the infrastructure.\nThe project remains unpatched, and functional exploit code is publicly available, significantly increasing the risk of exploitation.\nThe vulnerability is accessible remotely without specific authentication, making it a critical security concern.",
  "technicalDetails": "The vulnerability is a Server-Side Request Forgery (SSRF) affecting the HTML-to-PDF conversion functionality in 'projeto-siga' versions up to 11.1.1.\nThe root cause is improper input validation within the 'DownloadExterno.getUrl' function, located in 'sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java'.\nThe application accepts an 'html' parameter intended to provide content for conversion; however, the component fails to validate or sanitize the input, allowing an attacker to supply URLs or manipulate the endpoint's behavior.\nWhen the 'DownloadExterno.getUrl' function processes the malicious 'html' input, it executes a server-side request using the provided context.\nAn attacker can exploit this by crafting a request to the vulnerable endpoint, supplying a target URL in the 'html' argument that points to internal resources within the server's network segment or sensitive external endpoints.\nThe server, acting as a proxy, performs the request to the attacker-defined destination and potentially returns the result or error messages to the client, facilitating service enumeration, port scanning, or the extraction of internal metadata.\nBecause the function is reachable remotely, no pre-existing authentication or elevated privileges are required to initiate the attack.\nThe ability to force the application to make arbitrary outbound requests allows an attacker to bypass firewalls and access internal systems that are not typically exposed to the public internet.\nExploitation is trivialized by the availability of public exploit material, allowing threat actors to target vulnerable instances of 'projeto-siga' immediately.\nPost-exploitation impact includes unauthorized reading of internal files, interaction with internal APIs, or potential compromise of the host server if internal services are vulnerable to subsequent attacks."
}