CVE-2026-10771: crmeb crmeb_java base64 Qrcode Endpoint RestTemplateUtil.java RestTemplate.getForEntity server-side request forgery

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java::getForEntity from your environment.

   Remove or refactor the code that performs RestTemplate.getForEntity on user-supplied URLs. Replace with a safe implementation that does not perform arbitrary outbound requests or that uses an explicit allowlist.

2. Configuration

   Disable the base64 Qrcode endpoint (remove its route or return 404/403) until a code-level fix is implemented to eliminate SSRF.

   crmeb_java base64 Qrcode Endpoint (crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java) enabled = false
3. Configuration

   Do not pass user-controlled URLs directly to RestTemplate.getForEntity. Validate and sanitize the 'url' argument: allow only specific hostnames/IPs (host allowlist), reject requests to localhost, link-local, and private IP ranges, and block non-HTTP/HTTPS schemes.

   RestTemplateUtil.getForEntity usage (crmeb-common/src/main/java/com/zbkj/common/utils/RestTemplateUtil.java) url_input_validation = enforce host allowlist and scheme restrictions
4. Compensating control

   Apply network-level mitigations while code is fixed: restrict access to the vulnerable endpoint to trusted IPs via firewall or WAF rules; implement WAF rules to detect/block SSRF patterns; and enforce egress firewall rules to prevent application servers from making requests to internal network ranges and metadata services.

5. Operational

   Audit application and network logs for calls to the base64 Qrcode endpoint and for unusual outbound requests from the application. Investigate and remediate any suspicious activity discovered prior to applying fixes.

Event History

Frequently Asked Questions