Description
A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the component Network Request Handler. The manipulation of the argument targetIp/targetPort leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | PowerJob | 5.1.0, 5.1.1, 5.1.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | tech.powerjob:powerjob-common | <= 5.1.2 | — | GHSA-8xqm-6fj2-hfgf |
References
- VDB-335856 | PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery vdb-entry technical-description
- VDB-335856 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #702896 | PoweJob PowerJob <=5.1.2 SSRF third-party-advisory
- https://github.com/PowerJob/PowerJob/issues/1144 issue-tracking
- https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002 exploit issue-tracking
- https://github.com/PowerJob/PowerJob/ product