An unauthenticated SSRF vulnerability in PowerJob versions up to 5.1.2 allows remote attackers to force the server to connect to arbitrary internal or external network resources.

The vulnerability resides in the MuConnectionManager.getOrCreateConnection function within the TestController.java file. An unauthenticated attacker can supply arbitrary host and port parameters to the /test/transport endpoint, which the server uses to initiate outbound TCP connections without any validation or authentication.

The ability for an unauthenticated user to force the server to connect to arbitrary endpoints poses a significant security risk to internal network infrastructure. An attacker can leverage this to conduct internal port scanning, bypass firewalls, or interact with sensitive internal services that are otherwise unreachable from the public internet. Given the CVSS score of 7.3, this high-severity flaw could lead to network reconnaissance and facilitate further exploitation of internal systems.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /test/** endpoint via a Web Application Firewall or reverse proxy configuration to prevent unauthorized access.

Proactive Monitoring: Review web access logs for suspicious POST requests directed at /test/transport and monitor server egress traffic for anomalous connections to internal IP addresses or unauthorized external ports.

Compensating Controls: If the TestController is not required for production operations, ensure it is disabled or that the application is deployed using a Spring profile that excludes non-production testing endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the GitHub issue report referenced by the CVE.

This vulnerability represents a critical security oversight, as it exposes internal network services to remote, unauthenticated actors. Organizations running PowerJob should prioritize blocking the affected endpoint immediately. Security teams must remain vigilant for vendor-supplied patches and apply them as soon as they become available to permanently resolve the underlying SSRF risk.