glowxq glowxq-oj ProblemCaseController.java uploadTestcaseZipUrl 服务器端请求伪造 (Server-Side Request Forgery)

The SSRF vulnerability in glowxq-oj allows an attacker to craft malicious requests that the server will execute on its behalf. This can lead to unauthorized access to internal resources, such as internal APIs, databases, or cloud services that are not directly accessible from the outside world. An attacker could potentially read sensitive data, modify configurations, or even gain a foothold within the internal network. The availability of a public exploit significantly elevates the risk, as it lowers the barrier to entry for malicious actors. The impact is amplified if the glowxq-oj instance is exposed to the internet or interacts with other sensitive systems.

Organizations utilizing glowxq-oj in production environments, particularly those with continuous delivery pipelines, are at risk. Environments with limited network segmentation or exposed internal services are especially vulnerable. Shared hosting environments where multiple users share the same glowxq-oj instance also face increased risk.

• java / server:

# Monitor for suspicious outbound requests to internal resources
grep -i "internal.example.com" /var/log/access.log

• generic web:

# Check for unusual HTTP requests in access logs
curl -I <glowxq-oj_url>/business/business-oj/src/main/java/com/glowxq/oj/problem/controller/ProblemCaseController.java | grep -i "Server:"

1. 2026-03-16Disclosure

   disclosure

1. 已保留2026-03-15
2. 发布日期2026-03-16
3. EPSS 更新日期2026-03-23

Given the continuous delivery model of glowxq-oj, traditional version-based patching is not applicable. The primary mitigation strategy is to immediately upgrade to the latest available release. Implement strict input validation on all user-supplied data, particularly URLs, to prevent malicious manipulation. Consider deploying a Web Application Firewall (WAF) with SSRF protection rules to filter out potentially harmful requests. Restrict network access to the glowxq-oj instance to only necessary ports and services. After upgrading, verify the fix by attempting to trigger the SSRF vulnerability with a known malicious URL and confirming that the request is blocked or handled safely.