CVE-2026-10771: CRMEB Java SSRF Vulnerability in QR Code Endpoint

Technical summary

The vulnerability resides in the RestTemplateUtil.java component within the base64 QR code endpoint. The RestTemplate.getForEntity method fails to properly validate or restrict the URL argument passed by callers, allowing an unauthenticated attacker to inject arbitrary URLs. When the server processes the request, it will attempt to fetch content from the attacker-controlled URL, effectively acting as a proxy. This is classified as CWE-918 (Server-Side Request Forgery). The CVSS 3.1 score of 7.3 reflects the network-accessible attack vector, low complexity, and lack of privilege requirements, combined with potential impact to confidentiality, integrity, and availability.

Business impact

An active SSRF can enable attackers to probe internal network infrastructure, access non-public cloud metadata services, exfiltrate sensitive data from internal endpoints, or pivot deeper into the organization's network. In environments where CRMEB instances run alongside other backend systems, this becomes a bridgehead for lateral movement. The public disclosure of exploit code means this vulnerability transitions rapidly from theoretical to weaponized, increasing the urgency of remediation.

Affected systems

CRMEB Java version 1.4 is confirmed affected. The vulnerability is triggered through the base64 QR code endpoint, meaning any deployment exposing this functionality is at risk. Organizations using CRMEB for e-commerce or CRM workflows should verify their installed version and exposure of the REST API.

Exploitability

Exploitability is high. The attack requires no authentication, no user interaction, and runs over the network. The attack vector is straightforward: craft an HTTP request to the affected endpoint with a malicious URL parameter. Public exploit code is available, removing the barrier to weaponization. An attacker can immediately test internal connectivity and begin reconnaissance from a compromised CRMEB instance.

Remediation

Prioritize patching CRMEB Java to a version that validates and restricts URL inputs in the RestTemplate utility. Pending availability of an official patch from the project, implement network-level controls: restrict outbound connections from CRMEB instances to only necessary external services, disable access to cloud metadata endpoints (e.g., 169.254.169.254), and isolate CRMEB from sensitive internal services. Web application firewalls (WAF) can block suspicious URL patterns in requests to the QR code endpoint.

Patch guidance

Check the official CRMEB GitHub repository and security advisories for a patched version addressing CVE-2026-10771. Verify the patch version against the vendor advisory before deployment. Apply the patch in a staging environment first to confirm no breaking changes. If no patch is available from the vendor despite early notification, consider a temporary workaround: deploy a reverse proxy in front of CRMEB that validates URL parameters before they reach the vulnerable endpoint.

Detection guidance

Monitor HTTP requests to the base64 QR code endpoint for suspicious URL parameters that reference internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), cloud metadata services, or localhost. Examine outbound connections initiated by the CRMEB process to unexpected destinations. Log and alert on any RestTemplate.getForEntity calls with non-whitelist URLs. Intrusion detection systems can flag requests containing encoded internal IPs or metadata service markers in query parameters.

Why prioritize this

Despite not yet appearing on CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability merits immediate attention: HIGH CVSS score (7.3), network-accessible with no authentication, public exploit code available, and confirmed lack of vendor response. SSRF vulnerabilities are consistently weaponized in real-world attacks for reconnaissance and lateral movement. Organizations should treat this as an urgent patch candidate.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH) reflects a network-reachable attack requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), combined with potential impacts to confidentiality, integrity, and availability (C:L/I:L/A:L). The score would likely increase if this vulnerability were added to the KEV catalog or if widespread exploitation were documented, potentially reaching CRITICAL if combined with downstream abuse of internal services.

Frequently asked questions