xuxueli XXL-Job Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in xuxueli XXL-Job versions through 3.3.2. The issue resides in the JobInfoController, specifically within the triggerJob function. This vulnerability allows remote attackers to manipulate the target URI parameter, lacking proper security validation, and exploit internal services of the affected system.

Impact

Exploitation of this vulnerability allows for server-side request forgery, where an attacker can make the server send requests to internal services, potentially leading to further exploitation or information disclosure.

Reproduction

To reproduce this vulnerability, send a POST request to the '/xxl-job-admin/jobinfo/trigger' endpoint. Include an 'addressList' parameter with a URL pointing to an internal service. The request must be made with the appropriate XXL-JOB login cookies to simulate an authenticated user.