A critical Server-Side Request Forgery (SSRF) vulnerability in Mogu Blog v2 up to v5.2 enables remote attackers to perform unauthorized requests to internal network resources or the local filesystem.

The application fails to validate user avatar URLs during the OAuth callback process, which are subsequently processed by the LocalFileServiceImpl.uploadPictureByUrl function. This lack of input sanitization allows an unauthenticated attacker to manipulate the URL and trigger requests to arbitrary locations, including internal infrastructure.

Successful exploitation of this vulnerability can lead to severe security breaches, including the unauthorized disclosure of sensitive internal configuration data, cloud metadata, or local system files. Given the CVSS score of 7.3, this flaw presents a significant risk, as it allows attackers to bypass network perimeters and interact with services that are not exposed to the public internet.

Immediate Action: As no official patch is currently available, administrators should disable OAuth login functionality if it is not strictly required for business operations.

Proactive Monitoring: Review web server and application logs for suspicious outbound HTTP requests originating from the application server, particularly those targeting internal IP ranges or sensitive system files.

Compensating Controls: Deploy a Web Application Firewall (WAF) or egress filtering rules to restrict the application server from initiating connections to unauthorized external domains or internal network segments.

Public Exploit Available: Yes — a published proof-of-concept exists as documented in the GitHub repository referenced by the vulnerability disclosure.

The risk posed by this SSRF vulnerability is elevated due to the availability of public proof-of-concept material and the potential for lateral movement within the network. Organizations utilizing Mogu Blog must prioritize the implementation of egress filtering and, where possible, disable the vulnerable OAuth callback features until the vendor provides a formal security update.