Casdoor CVE-2026-108572

Requires that the target Casdoor instance (versions up to 3.164.0 / 4.10.0) exposes the CAS protocol proxy-validation endpoint (CasP3ProxyValidate) and that the attacker can reach it with a valid CAS service ticket - the CVSS PR:L confirms low-privilege authentication is needed, so this is not an unauthenticated flaw. The concrete trigger is attacker control of the pgtUrl (proxy-granting callback URL) argument, which the pre-patch code fetches via http.DefaultClient.Do without destination validation, redirect restriction, or timeout. Limiting factors: exploitation is confined to Casdoor deployments actually using CAS proxy authentication, requires a valid ticket, and impact is limited (VC:L, no integrity/availability impact), so this is primarily a blind/limited SSRF rather than full internal-service compromise. The 4.11.0 fix adds a non-redirect-following HTTP client with a 10-second timeout and target-authorization checks, confirming redirect-following and unbounded outbound requests were the core weakness.

This is a genuinely low-priority issue despite being a server-side request forgery flaw. The signals are internally consistent and point away from urgency: the vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) scores only 2.1, reflecting that exploitation requires low-level authentication (PR:L) and yields only limited confidentiality impact with no integrity or availability impact and no subsequent-system (scope) impact. The CVSS 4.0 exploit-maturity metric E:P and the description both confirm a public proof-of-concept exists, matching the 'exploit has been disclosed publicly' statement. However, there is NO EPSS score provided, NO CISA KEV listing, and the reporter is VulDB (cna@vuldb.com), a source that catalogs large volumes of lower-severity, often researcher-reported findings. So while a POC exists, there is no evidence of active exploitation. The SSRF is also constrained: the CVSS assigns only VC:L (not VC:H), implying limited data exposure rather than full internal-service compromise, and the patch (adding a no-redirect HTTP client with a 10s timeout) suggests the original flaw enabled unvalidated outbound requests/redirects rather than arbitrary full-response exfiltration. Net: a real but low-urgency bug - patch during normal maintenance cycles, prioritize only if Casdoor's CAS proxy-validation feature is internet-exposed.

An attacker who can obtain a valid CAS ticket in a Casdoor deployment sends a crafted request to the CasP3ProxyValidate endpoint with a malicious pgtUrl parameter pointing at an internal host or metadata endpoint. Because Casdoor performs an outbound HTTP request to the supplied pgtUrl during proxy-granting-ticket callback without sufficient validation, the server is coerced into contacting attacker-chosen internal destinations. A public proof-of-concept has been disclosed, lowering the barrier to attempt this, though impact is limited (VC:L) and authentication is required.