1. Executive Summary

2. Vulnerability Description

A Server-Side Request Forgery (SSRF) vulnerability exists in ContiNew Admin’s storage management module. The application allows administrators to configure S3-compatible object storage endpoints without properly validating whether the endpoint points to internal network addresses or cloud metadata services.

The vulnerability is located in S3ClientFactory.java where user-supplied endpoint URLs are directly passed to URI.create() and used to establish HTTP connections via AWS SDK’s S3Client, without any internal IP address or sensitive URL blacklist validation.

Repo: https://github.com/continew-org/continew-admin

3. Affected Components

3.1 Vulnerable Files

3.2 Vulnerable Code

S3ClientFactory.java (Line 43-55):

public S3Client getClient(StorageDO storage) {
    String key = storage.getEndpoint() + "|" + storage.getAccessKey();
    return CLIENT_CACHE.computeIfAbsent(key, k -> {
        StaticCredentialsProvider auth = StaticCredentialsProvider.create(
            AwsBasicCredentials.create(storage.getAccessKey(), storage.getSecretKey()));
        return S3Client.builder()
            .credentialsProvider(auth)
            .endpointOverride(URI.create(storage.getEndpoint()))  // VULNERABLE: No validation
            .region(Region.US_EAST_1)
            .serviceConfiguration(S3Configuration.builder()
                .chunkedEncodingEnabled(false).build())
            .build();
    });
}

StorageReq.java (Line 90-94) - Insufficient Validation:

@Schema(description = "Endpoint", example = "<http://oss-cn-shanghai.aliyuncs.com>")
@Length(max = 255, message = "Endpoint长度不能超过 {max} 个字符")
@NotBlank(message = "Endpoint不能为空", groups = ValidationGroup.Storage.OSS.class)
@Pattern(regexp = RegexConstants.URL_HTTP, message = "Endpoint格式不正确",
         groups = ValidationGroup.Storage.OSS.class)
private String endpoint;

RegexConstants.java (Line 65) - Weak Pattern:

// Only validates HTTP format, does NOT block internal IPs
public static final String URL_HTTP = "^(https?)://[\\\\w-+&@#/%?=~_|!:,.;]*[\\\\w-+&@#/%=~_|]$";

3.3 Validation Gap Analysis

4. Technical Details

4.1 Attack Vector Flow