YunaiV yudao-cloud Admin API Endpoint create IotDataSinkHttpConfig server-side request forgery

Vulnerability

A stored server-side request forgery (SSRF) vulnerability exists in the YunaiV yudao-cloud IoT module, version 2026.03. The flaw resides in the IotDataSinkHttpConfig handling within the /admin-api/iot/data-sink/create endpoint of the Admin API. When an authenticated administrator creates an HTTP data sink configuration, the provided URL is stored in the database without any validation of scheme, host, or IP address. Subsequently, when IoT device messages are processed, the stored URL is used directly by RestTemplate.postForObject() to make outbound HTTP requests, enabling SSRF attacks [1].

Exploitation

An attacker must first obtain valid administrator credentials to access the data sink creation endpoint. With that access, they can send a POST request to /admin-api/iot/data-sink/create containing a malicious URL (e.g., pointing to internal services or cloud metadata endpoints) in the IotDataSinkHttpConfig. Once the configuration is saved, the attacker triggers an IoT device message that causes the system to read the stored URL and execute an outbound request via RestTemplate without any IP filtering or protocol restrictions [1].

Impact

Successful exploitation allows the attacker to force the server to make arbitrary HTTP requests to internal network resources, cloud metadata services (e.g., 169.254.169.254), or other external systems. This can lead to information disclosure, lateral movement, or further compromise of the infrastructure. The SSRF is stored, meaning the malicious URL persists and can be triggered repeatedly [1].

Mitigation

As of the publication date, the vendor has not responded to disclosure and no official patch is available. Recommended mitigations include implementing strict URL validation (e.g., allow only HTTPS schemes), blocking requests to private and internal IP ranges, maintaining an allowlist of approved domains, and specifically blocking access to cloud metadata IPs such as 169.254.169.254 [1].