Executive brief
GEOFlow is an open-source content distribution platform used for managing and publishing geo-targeted content. A vulnerability in the endpoint validation function allows attackers to manipulate the endpoint URL parameter, enabling server-side request forgery attacks that could be used to scan internal networks, access internal services, or exfiltrate sensitive data from the server's perspective.
Technical details
A server-side request forgery (SSRF) vulnerability exists in the DistributionController.isValidHttpEndpoint function within app/Services/GeoFlow/GenericHttpEndpointResolver.php. The vulnerability arises from insufficient validation of the endpoint_url parameter, allowing an attacker to supply a malicious URL that causes the server to make requests to unintended destinations. The attack is network-accessible and requires no authentication. An attacker can exploit this to probe internal network resources, access internal services, or facilitate data exfiltration. A patch is available in version 2.1.1 (commit 67abfd864a15d169a78429f3290c91cb3b93e849); upgrading is recommended.
Affected products
- yaojingang GEOFlow up to 2.1.0
Timeline
- 2026-08-31: disclosed
- 2026-07-17: patched: Patch released in version 2.1.1