Executive brief
QingdaoU OnlineJudge, a platform for hosting programming competitions and practice, is vulnerable to a security flaw in its judge server management. An attacker with access to a judge server token can redirect the platform's internal requests to unintended locations. This could allow an attacker to scan internal networks, access sensitive cloud metadata, or disrupt the platform's operations.
Technical details
A stored Server-Side Request Forgery (SSRF) vulnerability exists in QingdaoU OnlineJudge up to version 1.6.1. The flaw is located in the `service_url` function within the `judge_server_heartbeat` endpoint. An attacker with a valid judge server token can submit a malicious URL via the `service_url` parameter in a POST request to `/api/admin/judge_server_heartbeat`. This URL is stored in the database without validation. When the application later dispatches tasks, it uses `requests.post()` to send data to the stored URL, allowing the attacker to force the server to make arbitrary requests to internal network resources or cloud metadata services. As of the advisory date, the vendor has not responded to disclosure attempts.
Affected products
- QingdaoU OnlineJudge up to 1.6.1
Timeline
- 2026-03-18: disclosed: Initial public disclosure via GitHub issue
- 2026-04-05: advisory: NVD/VulDB publication