📄 Description (English)
A vulnerability was detected in QingdaoU OnlineJudge up to 1.6.1. Affected by this issue is the function service_url of the file JudgeServer.service_url of the component judge_server_heartbeat Endpoint. The manipulation results in server-side request forgery. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
🤖 AI Executive Summary
CVE-2026-5538 is a Server-Side Request Forgery (SSRF) vulnerability in QingdaoU OnlineJudge versions up to 1.6.1, affecting the judge_server_heartbeat endpoint. With a CVSS score of 6.3 (medium), this vulnerability allows remote attackers to manipulate the service_url parameter to make unauthorized requests from the vulnerable server. No patch is currently available, and the vendor has not responded to disclosure attempts, requiring immediate compensating controls for affected organizations.
📄 Description (Arabic)
🤖 AI Intelligence Analysis Analyzed: May 18, 2026 17:23
🇸🇦 Saudi Arabia Impact Assessment
This vulnerability poses moderate risk to Saudi educational institutions and government agencies that deploy QingdaoU OnlineJudge for competitive programming platforms, online examinations, or coding assessment systems. Primary risk sectors include: (1) Higher Education institutions under MEHE supervision using online judge systems; (2) Government training centers and civil service examination platforms; (3) Technology companies providing coding assessment services. The SSRF vulnerability could enable attackers to access internal network resources, bypass firewalls, or pivot to internal systems. Saudi organizations should prioritize assessment of their deployment scope and implement network segmentation immediately.
🏢 Affected Saudi Sectors
Higher Education
Government and Public Administration
Technology and Software Development
Professional Training and Certification
Competitive Programming Platforms
🎯 MITRE ATT&CK Techniques
⚖️ Saudi Risk Score (AI)
5.8
/ 10.0
🔧 Remediation Steps (English)
Immediate Actions:
1. Inventory all QingdaoU OnlineJudge deployments in your organization and document versions
2. Implement network segmentation to restrict outbound connections from judge_server instances
3. Deploy Web Application Firewall (WAF) rules to block suspicious service_url parameters containing internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1)
4. Enable request logging and monitoring on the judge_server_heartbeat endpoint
Compensating Controls:
5. Implement strict input validation on service_url parameter - whitelist only approved external service endpoints
6. Disable or restrict the judge_server_heartbeat endpoint if not actively used
7. Apply network-level controls: restrict judge_server outbound access to only required external services
8. Monitor for exploitation attempts using these detection patterns:
- POST/GET requests to /judge_server_heartbeat with service_url containing: localhost, 127.0.0.1, internal IP ranges, file://, gopher://, dict://, ldap://, tftp://
- Unusual outbound connections from judge_server processes to internal network ranges
Patching Strategy:
9. Contact QingdaoU for security updates or consider alternative solutions
10. If no patch becomes available within 90 days, plan migration to patched alternatives
11. Maintain detailed change logs of all compensating control implementations
🔧 خطوات المعالجة (العربية)
الإجراءات الفورية:
1. قم بحصر جميع نشرات QingdaoU OnlineJudge في مؤسستك وتوثيق الإصدارات
2. تطبيق تقسيم الشبكة لتقييد الاتصالات الصادرة من نوى judge_server
3. نشر قواعد جدار حماية تطبيقات الويب (WAF) لحجب معاملات service_url المريبة التي تحتوي على نطاقات IP داخلية (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1)
4. تفعيل تسجيل المراقبة على نقطة نهاية judge_server_heartbeat
الضوابط التعويضية:
5. تطبيق التحقق الصارم من صحة معامل service_url - قائمة بيضاء للنقاط النهائية الخارجية المعتمدة فقط
6. تعطيل أو تقييد نقطة نهاية judge_server_heartbeat إذا لم تكن قيد الاستخدام النشط
7. تطبيق ضوابط على مستوى الشبكة: تقييد الوصول الصادر من judge_server إلى الخدمات الخارجية المطلوبة فقط
8. المراقبة لمحاولات الاستغلال باستخدام أنماط الكشف هذه:
- طلبات POST/GET إلى /judge_server_heartbeat مع service_url يحتوي على: localhost, 127.0.0.1, نطاقات IP داخلية, file://, gopher://, dict://, ldap://, tftp://
- اتصالات صادرة غير عادية من عمليات judge_server إلى نطاقات الشبكة الداخلية
استراتيجية التصحيح:
9. التواصل مع QingdaoU للحصول على تحديثات أمنية أو النظر في حلول بديلة
10. إذا لم يتوفر تصحيح خلال 90 يوماً، خطط للهجرة إلى بدائل محدثة
11. الحفاظ على سجلات تفصيلية لجميع تطبيقات الضوابط التعويضية
📋 Regulatory Compliance Mapping
🟢 NCA ECC 2024
A.5.1.1 - Information Security Policies and Procedures
A.5.2.1 - Access Control and Authentication
A.5.3.1 - Cryptography and Data Protection
A.5.4.1 - Physical and Environmental Security
A.5.5.1 - Operations Security
A.5.6.1 - Communications Security
A.5.7.1 - System Development and Maintenance
A.5.8.1 - Supplier Relationships
A.5.9.1 - Information Security Incident Management
🔵 SAMA CSF
Governance - Risk Management Framework
Protect - Access Control and Authentication
Protect - Data Protection and Privacy
Detect - Security Monitoring and Logging
Respond - Incident Response Procedures
🟡 ISO 27001:2022
A.5.1 - Policies for information security
A.5.2 - Information security roles and responsibilities
A.6.1 - Screening
A.6.2 - Terms and conditions of employment
A.7.1 - Prior to employment
A.7.2 - During employment
A.7.3 - Termination and change of employment
A.8.1 - User endpoint devices
A.8.2 - Privileged access rights
A.8.3 - Information access restriction
A.13.1 - Network security
A.13.2 - Information transfer
A.14.1 - Information security requirements analysis and specification
A.14.2 - Information security design and implementation
A.14.3 - Separation of development, test and production environments