CVE-2026-11469: jshERP Server-Side Request Forgery via Platform Configuration

Technical summary

The vulnerability resides in the insertPlatformConfig function within the PlatformConfigService.java component of jshERP-boot. The platformValue argument is not properly validated or sanitized before being used in server-side requests. This classic SSRF flaw (CWE-918) allows manipulation of the parameter to redirect HTTP requests initiated by the application server to attacker-controlled destinations. The attack surface is the platformConfig Add Endpoint, accessible only to authenticated users with administrative privileges. Exploitation does not require user interaction.

Business impact

Organizations deploying jshERP face potential data breach and lateral network movement if administrative credentials are compromised. An attacker gaining admin access could leverage this SSRF to scan internal network infrastructure, access internal services (databases, caches, APIs), or trigger actions on behalf of the server. This could lead to unauthorized access to sensitive business data, disruption of internal systems, or use of the server as a proxy for further attacks. The vulnerability is particularly concerning in supply chain scenarios where jshERP is integrated with multiple backend systems.

Affected systems

jishenghua jshERP versions up to and including 3.6 are affected. The vulnerability impacts the platformConfig management functionality in the jshERP-boot application. No patched version has been officially released by the vendor as of the modification date. Organizations should verify their jshERP deployment version against upstream advisories.

Exploitability

The vulnerability is exploitable remotely but requires high-privilege (administrator) authentication to the jshERP application. The attack has low complexity once a valid admin session exists. A published exploit is available, reducing the technical barrier for attackers with valid credentials. The requirement for administrative access significantly limits the exploitability window compared to pre-authentication flaws, but the availability of public exploit code means defenders should assume rapid weaponization if admin accounts are breached.

Remediation

Upgrade jshERP to a patched version when released by the vendor. Monitor vendor advisories and security communications closely, as the project has been notified but has not yet published a fix. Until a patch is available, implement strict access controls limiting administrative access to trusted personnel only, enforce multi-factor authentication for admin accounts, and segment jshERP from critical internal systems using network policies. Consider disabling the platformConfig Add Endpoint if not required for operations.

Patch guidance

Verify the latest available version of jshERP against the vendor's official release notes and security advisories at the jishenghua project repository. As no patched version number is currently documented in vulnerability databases, contact the vendor directly or monitor their GitHub releases for a fix addressing CWE-918 in the PlatformConfigService component. Apply patches to non-production environments first and validate that platformConfig functionality operates as expected before production deployment.

Detection guidance

Monitor HTTP logs and application request logs for suspicious POST requests to the platformConfig Add Endpoint originating from unusual internal or external IP addresses. Watch for platformValue parameters containing URLs, IP addresses, or hostnames pointing to internal services (127.0.0.1, private ranges, or internal domain names). Implement WAF rules to block platformValue payloads containing scheme indicators (http://, https://, ftp://, etc.). Enable and audit access logs for the PlatformConfigService component to identify unauthorized or anomalous admin activity. Consider network-level SSRF detection by monitoring outbound connections initiated by the jshERP process to unexpected destinations.

Why prioritize this

Despite a CVSS 4.7 MEDIUM score, this vulnerability warrants immediate attention due to SSRF capability, published exploit availability, and vendor non-response. While authentication is required, a compromised admin account immediately exposes internal infrastructure. Organizations should deprioritize only if jshERP is air-gapped, has zero external admin access, or is not integrated with sensitive backend systems. Patch when available and strengthen access controls immediately.

Risk score, explained

The CVSS 3.1 score of 4.7 reflects the authentication requirement (PR:H) which substantially lowers severity despite remote network accessibility (AV:N). The impact is partial—confidentiality, integrity, and availability are each limited to low impact (C:L/I:L/A:L). The vector indicates no user interaction required and no scope escalation. However, the real-world risk is elevated by the existence of a public exploit and the vendor's lack of response, making this a higher operational priority than the base score alone suggests.

Frequently asked questions