648540858 wvp-GB28181-pro IP Address ABLMediaNodeServerService.java getDownloadFilePath server-side request forgery

The SSRF vulnerability in wvp-GB28181-pro allows an attacker to craft malicious requests that originate from the server itself. This can be exploited to access internal resources that are not directly accessible from the outside world. For example, an attacker could potentially scan the internal network for open ports, access internal APIs, or even read sensitive configuration files. The ability to manipulate the streamIp argument directly contributes to the ease of exploitation. Given the public availability of an exploit, the risk of immediate exploitation is high.

Organizations deploying wvp-GB28181-pro, particularly those with internal services accessible via the component, are at risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as an attacker could potentially exploit the vulnerability to access resources belonging to other users.

• linux / server:

journalctl -u wvp-GB28181-pro | grep -i "streamIp"

• generic web:

curl -I <wvp-GB28181-pro_endpoint> | grep -i "X-Forwarded-For"

1. 2026-03-12Disclosure

   disclosure

2. 2026-03-12PoC

   poc

3. 2026-03-12CISA KEV

   kev

1. Gereserveerd2026-03-11
2. Gepubliceerd2026-03-12
3. EPSS bijgewerkt2026-03-23

Due to the vendor's lack of response, immediate mitigation options are limited. As a temporary workaround, implement strict input validation on the streamIp parameter, restricting allowed values to a whitelist of trusted IP addresses or domains. Consider deploying a Web Application Firewall (WAF) with rules to block suspicious outbound requests. Monitor network traffic for unusual outbound connections originating from the wvp-GB28181-pro server. After upgrading to a patched version (when available), confirm the fix by attempting to trigger the SSRF vulnerability with a known malicious payload; it should be blocked.