CVE-2024-13195 is a medium severity (CVSS 6.3) server-side request forgery in donglight bookstore 1.0.0, in the getHtml function of HttpUtil.java, through the url argument. The record says the exploit is public and gives no fix. Restrict outbound requests from the server and check the project issue.
What's affected
- donglight bookstore version 1.0.0.
- The affected function is getHtml in src/main/java/org/zdd/bookstore/rawl/HttpUtil.java, through the url argument.
The record names no fixed version, and it describes the exploit as publicly disclosed. Check the project's issue tracker and repository for a patch. If none exists, treat the project as unfixed.
How to check if you're exposed
Run the check below, or read the vendor or project notes linked in Sources.
# Look at your build file for the project and its version
grep -n -i donglight pom.xml
Compare the result to the affected range above.
What to do now
- Check whether the bookstore project is deployed anywhere.
- Read the linked issue for maintainer replies.
- Block outbound requests from the application host to private address ranges and cloud metadata addresses.
- If you keep the project, allowlist the sites its crawler is meant to fetch.
- Look up CVE-2024-13195 on its Gold page to see the current details and any fix information.
- Check your own dependency files with the free in-browser dependency scan. It runs in your browser and does not send the file to a server.
Why it matters
The function named in the record fetches HTML from a URL that a caller supplies. Without limits on what that URL can point to, the server can be asked to request internal addresses. The vector needs a low privilege account, so some login is needed, but any logged in user could use it.
The response to SSRF is layered. Validate the URL against an allowlist, resolve the host and refuse private ranges, and cut the network path with egress rules, since application checks alone are easy to get subtly wrong.
This CVE is a server-side request forgery flaw (CWE-918, Server-Side Request Forgery). Nothing in the record says it is exploited in the wild, and it is not marked as listed in CISA's Known Exploited Vulnerabilities catalog. That is a snapshot, so keep checking.
Server-side request forgery turns your web application into a proxy. The attacker supplies an address and your server makes the request, from inside your network, with your network permissions.
That matters because internal services often trust anything on the inside. Cloud metadata endpoints, admin panels bound to localhost and internal APIs may all answer a request that would never be allowed from the internet. The defenses are allowlisting the hosts a feature may contact, blocking private and link-local address ranges, and restricting outbound traffic from web servers at the network level.
Quick check
What does the url argument do?
According to the record, it is the input to getHtml, and manipulating it leads to server-side request forgery.
Is there a fix?
The record names none.
Sources
Note: these pages could not be retrieved when this post was written, so statements rest on the CVE record text. Check the vendor pages for the latest version information.
Last reviewed: 19 October 2026.
