JeecgBoot EUVD-2026-53713

The /airag/chat/send endpoint must be network-accessible to the attacker. The AI RAG chat feature with anonymous attachment parsing must be enabled and deployed - this component is not present in baseline JeecgBoot installations that do not use the AI RAG module, which limits exposure to organizations that have specifically configured this feature. No authentication is required, confirmed by PR:N in the CVSS 4.0 vector. The vulnerability affects only versions up to and including 3.9.2. Exploitation impact is bounded by the server's outbound network reachability: environments with egress filtering blocking internal ranges will prevent SSRF from reaching internal resources, though external SSRF targets remain accessible. No user interaction is required.

The CVSS 4.0 score of 6.9 with VC:L/VI:L/VA:L and no subsequent-system impact (SC:N/SI:N/SA:N) reflects a moderate but real risk tier. The most significant amplifying factor is PR:N - unauthenticated exploitation against the anonymous chat endpoint - combined with a publicly available POC (E:P). CISA KEV has not listed this CVE, so confirmed active exploitation is not established; however, the low exploitation barrier and public PoC mean opportunistic scanning is plausible. EPSS data was not provided in the input, so a quantified exploitation probability cannot be stated. The practical blast radius of an SSRF is environment-dependent: in cloud-hosted deployments, internal metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254) and internal microservices are primary targets, potentially escalating impact well beyond the moderate CVSS score. On-premises deployments with strict egress filtering face significantly reduced risk. No conflicting signals exist in the available data, but the absence of a vendor advisory means affected version boundaries are inferred from VulDB/NVD CPE data only.

An unauthenticated attacker sends a crafted HTTP POST request to the publicly accessible /airag/chat/send endpoint, embedding a malicious URL targeting an internal service (e.g., a cloud metadata endpoint or internal API) within the attachment parsing parameters. The JeecgBoot server processes the request and issues an outbound HTTP call to the attacker-specified destination, returning the response - exposing cloud credentials, internal service responses, or enabling internal port enumeration. Public exploit code exists in GitHub issue #9672, substantially reducing the technical skill required for exploitation.