projeto-siga SIGA CVE-2026-86273

The HTML-to-PDF endpoint (/sigaex path, ExUtilController.java) must be network-reachable. No authentication is required (CVSS PR:N, UI:N). The html request parameter must be accepted by the endpoint without URL filtering - this is the default behavior in affected versions. Exploitation impact scales significantly based on deployment context: cloud-hosted instances with IMDSv1 enabled face credential-theft risk; instances with network access to internal APIs or databases face lateral movement risk; instances on isolated networks with outbound filtering face reduced but non-zero impact (e.g., internal port scanning via timing). The exploit is limited to what the application server's outbound network can reach.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/E:P) yields a score of 6.9, reflecting straightforward network-accessible unauthenticated exploitation with limited-but-real impact across confidentiality, integrity, and availability. The absence of authentication requirements and low attack complexity makes this readily weaponizable against any internet-facing SIGA deployment. The public PoC (GitHub issue #2492) lowers the bar further - opportunistic scanners could reach this within hours of a deployment being indexed. However, the confined deployment footprint (primarily Brazilian federal judiciary infrastructure) limits absolute exposure compared to a vulnerability in ubiquitous software. SSRF impact is heavily deployment-dependent: cloud-hosted instances risk IMDSv1 metadata theft (AWS/GCP/Azure), while on-premises instances risk internal network pivoting. No KEV listing and no vendor patch exist at time of analysis. EPSS data is not provided; given the niche product and existing PoC, moderate short-term exploitation probability is plausible. The VA:L in the CVSS 4.0 vector is notable - extended SSRF can cause resource exhaustion or abuse the server as a proxy, justifying a minor availability impact. The lack of vendor response is a material risk amplifier.

An unauthenticated attacker sends an HTTP POST to SIGA's HTML-to-PDF endpoint with an html parameter containing an embedded reference to the AWS EC2 instance metadata service (e.g., an img tag pointing to http://169.254.169.254/latest/meta-data/iam/security-credentials/). The application server fetches the URL from its own network context, retrieves the IAM role credentials, and the response is available to the attacker - enabling lateral movement to AWS resources. A public proof-of-concept exploit exists in GitHub issue #2492.