CVE-2025-28089

Executive Summary

CVE-2025-28089 identifies a Server-Side Request Forgery (SSRF) vulnerability in maccms10 version v2025.1000.4047, specifically within the Scheduled Task function. This flaw allows an authenticated attacker to force the server to make arbitrary HTTP requests to internal or external resources, potentially leading to internal network reconnaissance, port scanning, or access to cloud metadata endpoints (e.g., AWS, GCP). The vulnerability is currently unpatched, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild at this time, but the risk remains significant for exposed instances.

Supply Chain & Package Security

This vulnerability affects the maccms10 content management system, which is a PHP-based application. No package manager (NPM, PyPI, Go, Ruby) is involved. The risk is primarily to self-hosted instances.

CVSS Breakdown & Threat Level

The CVSS vector is unknown due to insufficient data from the NVD. However, based on the nature of SSRF, a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L) – the Scheduled Task function is accessible to authenticated users.
• Privileges Required (PR): Low (L) – requires authentication to the admin panel.
• User Interaction (UI): None (N)
• Scope (S): Changed (C) – the attack can impact resources beyond the vulnerable component (e.g., internal network).
• Confidentiality (C): High (H) – potential to read internal files or cloud metadata.
• Integrity (I): None (N) – SSRF typically does not allow data modification.
• Availability (A): None (N)

Estimated CVSS Score: 8.3 (High)

Threat Level: High. While no public exploit exists, the vulnerability is trivial to exploit once discovered, and the impact on internal network security is severe.

Deep Dive & Mechanics

The vulnerability resides in the Scheduled Task functionality of maccms10. Scheduled tasks allow administrators to define periodic actions, such as fetching remote data or triggering internal scripts. The flaw is that the application does not properly validate or sanitize the URL or hostname provided in the task configuration.

Attack Flow:

1. An attacker with admin-level access navigates to the Scheduled Task management page.
2. The attacker creates a new task and sets the "target URL" or "callback URL" to an internal resource, such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://internal-server:8080/admin.
3. The server executes the task, making an HTTP request to the attacker-specified URL.
4. The response (if any) is either displayed in the task logs or returned to the attacker, leaking sensitive information.

Root Cause: Lack of input validation on the URL parameter in the task creation/editing form. The application likely uses a function like file_get_contents() or curl_exec() without restricting the destination to allowed domains or IP ranges.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual PHP):

// In scheduled_task.php
$url = $_POST['task_url'];
$response = file_get_contents($url); // No validation
log_task_result($response);

Patched Code (Hypothetical):

// In scheduled_task.php
$url = $_POST['task_url'];
$parsed_url = parse_url($url);
$host = $parsed_url['host'] ?? '';

// Block private and reserved IPs
if (filter_var($host, FILTER_VALIDATE_IP)) {
    if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        die("Blocked: internal IP");
    }
}

// Allow only specific domains
$allowed_domains = ['api.example.com', 'cdn.example.com'];
if (!in_array($host, $allowed_domains)) {
    die("Blocked: domain not allowed");
}

$response = file_get_contents($url);
log_task_result($response);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Admin credentials for maccms10.
• Network access to the maccms10 server.

Steps:

1. Log in to the maccms10 admin panel.
2. Navigate to System -> Scheduled Tasks.
3. Click "Add Task".
4. Set the following parameters:
   • Task Name: SSRF Test
   • Task Type: HTTP Request
   • Target URL: http://169.254.169.254/latest/meta-data/
   • Interval: Once
5. Save and execute the task.
6. Check the task logs for the response, which will contain AWS metadata (if running on AWS).

Alternative Payloads:

• http://127.0.0.1:8080/admin – internal admin interface.
• file:///etc/passwd – local file read (if allow_url_fopen is enabled).
• gopher://internal-redis:6379/_*1%0d%0a$4%0d%0aPING%0d%0a – Redis protocol injection.

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests from the maccms10 server to unexpected destinations (especially private IPs).
• Look for task logs containing responses from internal services.
• Alert on any task that uses a URL with an IP address instead of a domain name.

Hardening:

• Restrict outbound network access from the maccms10 server using a firewall or iptables.
• Disable the Scheduled Task feature if not needed.
• Implement a web application firewall (WAF) rule to block requests to private IP ranges.
• Apply the principle of least privilege: ensure the web server user cannot access sensitive internal services.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.
  • Requests to file:// or gopher:// schemes.
• File IOCs:
  • Task logs containing responses from internal services (e.g., AWS metadata JSON).
• Behavioral IOCs:
  • Creation of scheduled tasks with unusual URLs (IP addresses, internal hostnames).
  • Multiple failed login attempts followed by task creation (indicates attacker gaining access).

Detection Engineering

YARA Rule

rule CVE_2025_28089_SSRF_Maccms10 {
    meta:
        description = "Detects SSRF exploitation attempts in maccms10 scheduled task logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28089"
    strings:
        $s1 = "169.254.169.254" ascii wide nocase
        $s2 = "metadata" ascii wide nocase
        $s3 = "file://" ascii wide nocase
        $s4 = "gopher://" ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
        $s7 = "172." ascii wide nocase
    condition:
        any of ($s1, $s2, $s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-28089 SSRF via Maccms10 Scheduled Task
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects outbound HTTP requests from maccms10 to private IP ranges or cloud metadata endpoints.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28089
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_ip:
            - '10.0.0.0/8'
            - '172.16.0.0/12'
            - '192.168.0.0/16'
            - '169.254.169.254'
        dest_port: 80
        app_protocol: http
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high
tags:
    - attack.t1190
    - cve.2025.28089

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28089 Maccms10 SSRF Outbound to Private IP"; flow:to_server; content:"GET /"; http_method; content:"Host:"; http_header; pcre:"/^Host:\s*(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/mi"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Scheduled Tasks: If not required, disable the Scheduled Task feature entirely in the maccms10 configuration.
2. Restrict Network Access: Use a firewall to block outbound traffic from the maccms10 server to private IP ranges and cloud metadata endpoints.
3. Apply Input Validation: Manually patch the code to validate and restrict URLs to a whitelist of allowed domains.

Long-Term Fix:

• Await an official patch from the vendor. If none is forthcoming, consider migrating to a different CMS.
• Implement a web application firewall (WAF) with rules to block SSRF attempts.
• Regularly audit admin accounts and logs for suspicious activity.

Workaround:

• Modify the PHP code to use a custom function that resolves the hostname and blocks private IPs before making the request.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal. Always ensure you have explicit permission before testing any system.