Jeesite XXE Vulnerability (CWE-611): Unfiltered logoutRequest Causes SSRF

Jeesite XXE Vulnerability Report (CWE-611) 1. Description Jeesite contains an XXE vulnerability. The user-controlled XML is parsed without adequate XXE protections, enabling attacker-controlled entities to trigger server-side outbound requests (SSRF impact). 2. Vulnerability Path (Source -> Sink) 1. The route is mapped to the filter: , with default . - data/project-sources/jeesite5.15.1/modules/core/src/main/resources/config/jeesite-core.yml:573 - data/project-sources/jeesite5.15.1/modules/core/src/main/resources/config/jeesite-core.yml:180 2. The application context path is , so the actual endpoint is . - data/project-sources/jeesite5.15.1/web/src/main/resources/config/application.yml:28 3. initiates the authentication flow ( ). - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite-module-cas-5.15.1.springboot3-20260127.124313-1/com/jeesite/common/shiro/cas/CasBaseFilter.java:43 4. enters the SLO branch and invokes . - data/project-sources/jeesite5.15.1/modules/core/src/main/java/com/jeesite/common/shiro/realm/CasAuthorizingRealm.java:60 - data/project-sources/jeesite5.15.1/modules/core/src/main/java/com/jeesite/common/shiro/realm/CasAuthorizingRealm.java:61 5. directly returns for POST . - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite-module-cas-5.15.1.springboot3-20260127.124313-1/org/jasig/cas/client/util/CommonUtils.java:151 - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite-module-cas-5.15.1.springboot3-20260127.124313-1/org/jasig/cas/client/util/CommonUtils.java:154 6. is passed into , which uses + without any XXE mitigation measures. - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite/common/shiro/cas/CasOutHandler.java:89 - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite-module-cas-5.15.1.springboot3-20260127.124313-1/org/jasig/cas/client/util/XmlUtils.java:27 - data/project-sources/jeesite5.15.1/m2-decompiled-src/jeesite-module-cas/5.15.1.springboot3-SNAPSHOT/jeesite-module-cas-5.15.1.springboot3-20260127.124313-1/org/jasig/cas/client/util/XmlUtils.java:106 3. Analysis of Key Vulnerability Code 3.1 User Input Reaches the Sink Directly This explicitly allows POST to flow directly into subsequent processing, making the input fully attacker-controlled. 3.2 Dangerous Parsing Point The (user-controlled XML) is passed directly to XML parsing. No security hardening such as is applied, leaving the system vulnerable to XXE attacks. 4. Verification Code Run example: 4.3 Key Payload

Goal Reached Thanks to every supporter — we hit 100%!

Jeesite XXE Vulnerability (CWE-611): Unfiltered logoutRequest Causes SSRF