An unauthenticated server-side request forgery (SSRF) and arbitrary file read vulnerability in Mogu Blog v2 allows remote attackers to exfiltrate sensitive data and compromise internal network infrastructure.

The vulnerability resides in the LocalFileServiceImpl.uploadPictureByUrl function, which fails to properly validate user-supplied URLs or authentication tokens. An unauthenticated attacker can manipulate the request body to force the server to fetch arbitrary files or interact with internal services.

The exploitation of this flaw can lead to a total loss of confidentiality and integrity for the affected server. Attackers can read sensitive configuration files, retrieve cloud environment metadata, or pivot into internal networks to access non-public services. While the CVSS score is 7.3, the ability for an unauthenticated attacker to read arbitrary files and scan internal infrastructure presents a severe risk to organizational security.

Immediate Action: As no official patch is currently available, administrators should immediately disable the URL-based file upload feature or restrict access to the /file/uploadPicsByUrl endpoint by implementing strict authentication requirements at the network or application level.

Proactive Monitoring: Monitor server access logs for anomalous POST requests to the /file/uploadPicsByUrl endpoint, specifically those containing suspicious URL schemes such as file:// or internal IP addresses in the request payload.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing sensitive URI schemes or attempts to access internal metadata services (e.g., 169.254.169.254) from the application server.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the referenced security report by the researcher.

Given the availability of a public proof-of-concept and the critical nature of the exposure, organizations using Mogu Blog v2 must prioritize limiting access to this application immediately. Until the vendor provides a formal update, treat the affected server as compromised if it is exposed to the internet. Administrators should review all logs for evidence of unauthorized file access or internal network scanning originating from the application host.