CVE-2026-11469: jishenghua jshERP platformConfig Add Endpoint PlatformConfigService.java insertPlatformConfig server-side request forgery

Affected Software

Remediation

Recommended actions to resolve this vulnerability, in priority order.

1. Remove

   Remove jishenghua jshERP platformConfig Add Endpoint from your environment.

   Remove or comment out the platformConfig Add Endpoint code (PlatformConfigService.java insertPlatformConfig) if the endpoint is not required, to eliminate the SSRF vector.

2. Configuration

   Validate and sanitize the platformValue argument in insertPlatformConfig: reject or normalize any input that looks like a URL/URI or contains host/port schemes; enforce a strict allowlist of acceptable values or formats and perform server-side validation before any network access.

   jishenghua jshERP platformConfig Add Endpoint (PlatformConfigService.java insertPlatformConfig) platformValue input validation = apply strict validation/allowlist and disallow remote URLs/URIs
3. Configuration

   Disable the platformConfig Add Endpoint (insertPlatformConfig) until a patch is available if the functionality is not required.

   jishenghua jshERP platformConfig Add Endpoint = disabled
4. Compensating control

   Block or restrict outbound network access from the application host: implement egress firewall rules, require outbound requests go through a proxy that enforces an allowlist, and prevent requests to internal-only IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).

5. Operational

   Investigate and monitor for exploitation: review access and application logs for use of the platformConfig Add Endpoint and suspicious platformValue inputs; if exploitation is suspected, perform incident response actions such as isolating the host and rotating any credentials or secrets that may have been accessed.

Event History

Frequently Asked Questions