erzhongxmu JEEWMS UEditor getRemoteImage.jsp falsificación de solicitud del lado del servidor

The SSRF vulnerability in JEEWMS 3.7 allows an attacker to craft malicious requests through the upfile parameter within the /plug-in/ueditor/jsp/getRemoteImage.jsp endpoint. This can be leveraged to make the server initiate requests to internal resources that are otherwise inaccessible from the outside. An attacker could potentially scan internal networks, access sensitive data stored on internal servers, or even interact with internal APIs. The impact extends beyond simple data exposure; an attacker could potentially use the server as a proxy to bypass firewalls and access restricted services. This vulnerability is particularly concerning given its public disclosure and the potential for widespread exploitation.

Organizations using JEEWMS 3.7, particularly those with exposed UEditor instances or internal services accessible via the JEEWMS server, are at significant risk. Shared hosting environments where JEEWMS is deployed alongside other applications are also vulnerable, as a compromise of one instance could potentially lead to lateral movement and impact other tenants.

• java / server:

journalctl -u jeeewms -f | grep "getRemoteImage.jsp"

• generic web:

curl -I <JEEWMS_URL>/plug-in/ueditor/jsp/getRemoteImage.jsp?upfile=http://internal.server/sensitive_data.txt

• generic web:

grep -r 'getRemoteImage.jsp' /var/log/apache2/access.log

1. 2026-02-23Disclosure

   disclosure

1. Reservado2026-02-23
2. Publicada2026-02-23
3. Modificada2026-02-25
4. EPSS actualizado2026-03-23

Due to the lack of a provided fixed_in version, immediate mitigation strategies are crucial. Implement a Web Application Firewall (WAF) rule to block requests to /plug-in/ueditor/jsp/getRemoteImage.jsp with suspicious or unexpected values in the upfile parameter. Restrict network access to the JEEWMS server, limiting outbound connections to only necessary services. Thoroughly review and audit the UEditor configuration, ensuring that it adheres to security best practices. Monitor access logs for unusual activity related to the getRemoteImage.jsp endpoint. After applying these mitigations, verify their effectiveness by attempting to trigger the SSRF vulnerability with a controlled request.