Executive brief
Hippo4j is an asynchronous thread pool management framework that monitors and controls thread pools in Java applications. A flaw in four REST endpoints fails to validate the clientAddress parameter, allowing authenticated attackers to trigger outbound HTTP requests to arbitrary internal systems and cloud metadata services, potentially exposing sensitive configuration and credentials.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the ThreadPoolController endpoints of Hippo4j. The affected endpoints accept a clientAddress parameter that is used in GET requests without proper validation or filtering. An authenticated attacker can supply arbitrary hostnames and ports to force the server to make outbound requests to internal networks, cloud metadata services (e.g., AWS EC2 metadata), or other restricted endpoints. The attack requires authentication, limiting exposure to authenticated users. Patches are expected to implement hostname/IP whitelisting and validation to prevent requests to reserved address ranges.
Affected products
- opengoofy Hippo4j through 1.5.0
Timeline
- 2026-09-16: disclosed