An unauthenticated Server-Side Request Forgery vulnerability in the glowxq-oj platform allows remote attackers to manipulate internal requests, posing a significant risk to network infrastructure.

The application is susceptible to Server-Side Request Forgery (SSRF) within the uploadTestcaseZipUrl function located in the ProblemCaseController.java file. An unauthenticated attacker can exploit this flaw to force the server to initiate arbitrary network requests.

Successful exploitation of this vulnerability allows an attacker to interact with internal services that are otherwise protected from the public internet. This can lead to unauthorized data access, reconnaissance of internal network segments, or the bypassing of firewall controls, justifying the reported CVSS score of 7.3.

Immediate Action: Since no official patch version is available, restrict access to the affected controller endpoint via network segmentation or block the specific URL path at the application perimeter.

Proactive Monitoring: Review web server and application logs for suspicious outbound requests originating from the server, specifically targeting internal IP addresses or sensitive metadata services.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and filter URL parameters passed to the uploadTestcaseZipUrl function to prevent the submission of unauthorized target addresses.

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the linked technical write-up.

Due to the lack of an official vendor patch and the availability of a public proof-of-concept, users of the glowxq-oj platform should treat this as a high-priority risk. Administrators must immediately implement compensating controls to restrict access to the vulnerable endpoint and monitor for signs of unauthorized outbound traffic to prevent potential compromise of internal systems.