Dromara MaxKey Server-Side Request Forgery Vulnerability in SAML20DetailsController

A critical server-side request forgery (SSRF) vulnerability has been identified in Dromara MaxKey versions through 4.1.7. The issue arises in the SAML20DetailsController component, specifically within the Add function of the Meta URL Handler. The vulnerability allows remote attackers to manipulate the post argument, potentially leading to unauthorized requests being sent from the server to internal or external resources.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests on its behalf. This could be used to access internal services or resources that are not normally exposed to the outside world.