Description

A vulnerability was determined in taisan tarzan-cms 1.0.0. This issue affects the function openConnection of the file com/tarzan/cms/modules/admin/service/biz/ThemeService.java of the component Theme Download Function. Executing a manipulation of the argument httpUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-09-14T12:17:51.043Z",
  "pubdate": "2026-09-14T12:17:51.043Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in the Theme Download Function of taisan tarzan-cms version 1.0.0.\nThe vulnerability resides within the openConnection function of the com/tarzan/cms/modules/admin/service/biz/ThemeService.java file.\nThe issue arises from improper validation of the httpUrl argument, allowing an attacker to coerce the server into making unauthorized requests to arbitrary internal or external resources.\nThe vulnerability is remotely exploitable, requiring no prior authentication depending on the configuration, and poses a significant risk to internal network security.\nSuccessful exploitation allows attackers to bypass perimeter security controls, perform port scanning of internal infrastructure, access sensitive internal APIs, or interact with metadata services in cloud environments.\nThe project maintainers have been notified of the vulnerability but have not yet provided a resolution, meaning the risk remains present in deployments of the specified version.",
  "technicalDetails": "The vulnerability is categorized as a Server-Side Request Forgery (SSRF) flaw, rooted in the inadequate sanitization and validation of user-supplied input provided to the httpUrl argument within the ThemeService component.\nSpecifically, the com/tarzan/cms/modules/admin/service/biz/ThemeService.java file contains an openConnection function designed to handle theme downloading. This function accepts a URL as input and initiates an outbound network request using that URL without verifying if the target destination is legitimate or permissible.\nThe attack flow begins when an attacker provides a crafted URL to the vulnerable httpUrl parameter. When the application processes this input, the openConnection function utilizes the provided URL to establish a connection. Because the application acts as a proxy for this request, the attacker can supply URLs pointing to internal IP addresses (e.g., 127.0.0.1, 169.254.169.254), private subnets, or sensitive internal services that are not exposed to the public internet.\nBy manipulating the httpUrl argument, an attacker can effectively pivot their access into the internal network environment where the application server resides. If the server is deployed within a cloud environment, such as AWS, GCP, or Azure, the attacker may attempt to access the instance metadata service to exfiltrate security credentials or configuration data.\nFurthermore, the vulnerability allows for protocol smuggling or unauthorized access to internal services that rely on implicit trust based on the source IP address. For instance, an attacker could interact with internal administrative interfaces, databases, or Redis caches that are bound to localhost but lack external authentication requirements.\nThe exploitation process is straightforward and does not require complex payloads; it primarily involves sending an HTTP request containing the malicious URL parameter to the application endpoint responsible for triggering the Theme Download Function. Since the vulnerability is remotely exploitable, any attacker with network access to the application can leverage this flaw to conduct reconnaissance or perform unauthorized actions against the underlying infrastructure."
}