Yalantis uCrop Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in Yalantis uCrop version 2.2.11. The issue arises in the 'downloadFile' function within 'com.yalantis.ucrop.task.BitmapLoadTask.java', specifically in the URL handling component. This vulnerability allows remote exploitation by manipulating input, leading the server to make unintended requests.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where the server is tricked into making requests to internal or external resources on behalf of the attacker. This could potentially be used to access sensitive information or services that are not normally exposed to the public.