Description

A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file src/main/java/com/github/fge/jackson/JsonLoader.java of the component URL Validation. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-07T16:17:30.547Z",
  "pubdate": "2026-09-07T16:17:30.547Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the java-json-tools jackson-coreutils library, specifically within the JsonLoader.fromURL function.\nThis vulnerability allows a remote, unauthenticated attacker to manipulate the URL input, potentially forcing the server to make unauthorized requests to internal or external resources.\nThe issue resides in the URL validation logic of the component, which fails to adequately sanitize or restrict the URI schemes and destinations provided to the loader.\nSuccessful exploitation can result in unauthorized access to sensitive internal services, internal port scanning, or the retrieval of sensitive metadata from cloud environments.\nGiven that the exploit is publicly available and the project has not provided a response or official patch, the risk to applications relying on this component is high.\nImplementation of input validation and egress filtering is required to protect systems utilizing this library.",
  "technicalDetails": "The vulnerability originates in the src/main/java/com/github/fge/jackson/JsonLoader.java file within the JsonLoader.fromURL method. The root cause is insufficient validation of the URL parameter passed to the function before it is used to perform a network request.\nIn typical implementations of this component, the application accepts a URL from a user or an external source and passes it directly to the fromURL method. Because the validation logic does not restrict the protocol or the resolution of the hostname, the underlying library allows the client to initiate requests to arbitrary locations, including local resources or internal network addresses (e.g., localhost, 127.0.0.1, or cloud metadata endpoints like 169.254.169.254).\nThe attack flow proceeds as follows: 1) An attacker identifies an application endpoint that invokes JsonLoader.fromURL with user-controllable input. 2) The attacker crafts a malicious request by supplying a URL pointing to a targeted internal service or metadata service. 3) The component, upon receiving this input, performs the request on behalf of the server. 4) The server acts as a proxy, receiving the response from the internal target and potentially returning data to the attacker, or using the response to perform actions within the internal network.\nSince the vulnerability is in the core utility logic used to fetch JSON data, any application leveraging jackson-coreutils version 2.0 to load JSON from external URLs is susceptible. No authentication is required to trigger the vulnerability, as it typically manifests at the application's entry points. The exploitation is entirely remote and does not require elevated privileges on the target system. Post-exploitation impact varies depending on the server's network configuration; an attacker could bypass firewall rules, interact with internal APIs that lack secondary authentication, or perform reconnaissance on the internal infrastructure through the server's privileged position within the network. The public nature of the exploit significantly lowers the bar for exploitation, as automated scanners and malicious actors can easily weaponize the flaw to conduct targeted probes."
}