CVE-2025-11636

Executive Summary

CVE-2025-11636 identifies a Server-Side Request Forgery (SSRF) vulnerability in the Tomofun Furbo 360 pet camera, specifically in firmware version FB0035_FW_036. The vulnerability resides in the Account Handler component, allowing an attacker to manipulate the device into making unauthorized requests to internal or external resources. The attack is remotely exploitable but is characterized by high complexity, making it difficult to execute. The vendor, Tomofun, was contacted but did not respond, leaving the vulnerability unpatched at the time of this report. This SSRF flaw could be leveraged to bypass network restrictions, access internal services, or perform reconnaissance on the device's network.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the description (remote, high complexity, SSRF), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): High (H)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): Low (L)
• Integrity (I): None (N)
• Availability (A): None (N)
• Base Score: 3.7 (Low)

Threat Level: Low (due to high complexity and limited impact, but SSRF can be chained with other vulnerabilities for greater effect).

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the Account Handler component of the Furbo 360 firmware. The Account Handler likely processes user-supplied URLs or IP addresses for account-related operations (e.g., verifying a server, fetching a resource). Due to insufficient validation, an attacker can inject a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata or http://internal-service:8080/admin) that the device's server-side logic will fetch. This allows the attacker to:

• Bypass network ACLs: The request originates from the device's internal IP, which may have access to internal services.
• Port scan internal hosts: By observing response times or error messages, the attacker can map internal services.
• Access cloud metadata: If the device is hosted in a cloud environment, the attacker could retrieve IAM credentials or configuration data.
• Exploit other internal services: The SSRF can be used to interact with other vulnerable services on the same network.

The high complexity likely stems from the need to bypass input filters, understand the device's network topology, or chain the SSRF with another vulnerability.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a typical vulnerable code pattern for SSRF in an Account Handler might look like:

Vulnerable Code (Python-like pseudocode):

def verify_account(server_url):
    # No validation of server_url
    response = requests.get(server_url)
    return response.text

Patched Code (Hypothetical):

def verify_account(server_url):
    # Validate URL against a whitelist
    allowed_domains = ["api.tomofun.com", "auth.tomofun.com"]
    parsed = urlparse(server_url)
    if parsed.hostname not in allowed_domains:
        raise ValueError("Invalid server URL")
    response = requests.get(server_url)
    return response.text

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Tomofun Furbo 360 device with firmware FB0035_FW_036.
• Network access to the device (local or remote if exposed).
• Understanding of the Account Handler endpoint (likely via API documentation or reverse engineering).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a proxy (e.g., Burp Suite) to intercept traffic from the Furbo app to the device. Look for requests to /account/verify or similar endpoints that accept a URL parameter.
2. Craft the SSRF payload: Replace the URL parameter with an internal target, e.g., http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://127.0.0.1:8080/admin.
3. Send the request: Use a tool like curl or Burp Repeater to send the malicious request.
4. Observe the response: The device will fetch the internal resource and return the response to the attacker.

Example curl command:

curl -X POST "http://<furbo-ip>/account/verify" \
  -d "server_url=http://169.254.169.254/latest/meta-data/"

Expected Output: The response will contain the cloud metadata (if applicable) or an error message that reveals internal service information.

Blue Team (Detection & Defense)

Detection:

• Monitor outbound HTTP requests from the Furbo device to unexpected IPs (e.g., private IP ranges like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 169.254.0.0/16).
• Look for requests to cloud metadata endpoints (e.g., 169.254.169.254).
• Analyze logs for unusual URL parameters in the Account Handler endpoint.

Defense:

• Network Segmentation: Place IoT devices like the Furbo on a separate VLAN with strict egress filtering.
• Input Validation: Implement a whitelist of allowed URLs for the Account Handler.
• Disable Unnecessary Features: If the Account Handler is not needed, disable it.
• Monitor for Anomalies: Use a SIEM to alert on SSRF patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
  • Requests to cloud metadata endpoints (e.g., http://169.254.169.254/).
  • Unusual URL parameters in the Account Handler endpoint (e.g., server_url=http://internal-service).
• Host IOCs:
  • Log entries showing failed or successful requests to internal IPs from the Furbo device.
  • Unexpected processes or network connections initiated by the Furbo firmware.

Detection Engineering

YARA Rule

rule CVE_2025_11636_SSRF_Furbo {
    meta:
        description = "Detects SSRF attempts targeting internal IPs in Furbo 360 traffic"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11636"
    strings:
        $internal_ip = /(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $metadata_endpoint = "169.254.169.254"
        $account_handler = "/account/verify"
    condition:
        $account_handler and ($internal_ip or $metadata_endpoint)
}

Sigma Rule

title: CVE-2025-11636 SSRF Attempt on Furbo 360
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts targeting internal IPs or cloud metadata from Furbo 360 devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11636
logsource:
    category: network
    product: suricata
detection:
    selection:
        dest_ip:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.0.0/16'
        http.uri: '/account/verify'
    condition: selection
falsepositives:
    - Legitimate internal service calls (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-11636 SSRF Attempt on Furbo 360"; flow:to_server; content:"/account/verify"; http_uri; content:"server_url"; http_client_body; pcre:"/(?:10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(?:1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Account Handler: If possible, block access to the vulnerable endpoint via firewall or device configuration.
2. Network Segmentation: Isolate the Furbo 360 on a separate VLAN with strict egress rules to prevent SSRF from reaching internal resources.
3. Monitor for Exploitation: Deploy the provided detection rules to identify any SSRF attempts.

Long-Term Fix:

• Vendor Patch: Await an official firmware update from Tomofun. Since the vendor did not respond, consider replacing the device or implementing a reverse proxy that validates all outbound requests.
• Input Validation: Implement a whitelist of allowed URLs in the Account Handler.
• Disable Unused Features: If the Account Handler is not critical, disable it entirely.

Valters IT