CVE-2025-28090

Executive Summary

CVE-2025-28090 identifies a Server-Side Request Forgery (SSRF) vulnerability in the Collection Custom Interface feature of maccms10 version v2025.1000.4047. This flaw allows an attacker to induce the server to make HTTP requests to arbitrary internal or external resources, potentially leading to internal network reconnaissance, data exfiltration, or further exploitation of internal services. The vulnerability is currently unpatched, and no public proof-of-concept or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using this software in internal or exposed environments.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated value. Based on the vulnerability type (SSRF) and typical impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs some level of access to the Collection Custom Interface feature.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – SSRF can expose sensitive internal data.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Potential to cause denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Threat Level: High – SSRF vulnerabilities can lead to severe internal network compromise.

Deep Dive & Mechanics

The vulnerability resides in the Collection Custom Interface feature of maccms10. This feature likely allows administrators to define custom data sources or endpoints for content aggregation. The SSRF occurs when the application fails to properly validate or sanitize user-supplied URLs before making HTTP requests.

Attack Flow:

1. An attacker with access to the Collection Custom Interface (e.g., an authenticated admin or a user with sufficient privileges) crafts a malicious URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://localhost:8080/admin for internal services).
2. The application processes this URL and makes an HTTP request to the specified target.
3. The response from the internal resource is then reflected back to the attacker, either directly in the application output or through error messages, enabling data exfiltration.

Root Cause: Lack of input validation and URL whitelisting. The application does not restrict the scheme, host, or port of the URL, allowing arbitrary HTTP requests.

Vulnerable vs. Patched Code

Since no patch is available, a comparison cannot be made. However, a secure implementation would include:

• Vulnerable Code (Conceptual):

  $url = $_POST['custom_url'];
  $response = file_get_contents($url);
  echo $response;
  

• Patched Code (Conceptual):

  $url = $_POST['custom_url'];
  $parsed_url = parse_url($url);
  $allowed_hosts = ['api.example.com', 'data.example.com'];
  if (!in_array($parsed_url['host'], $allowed_hosts)) {
      die('Invalid URL');
  }
  $response = file_get_contents($url);
  echo $response;
  

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable instance of maccms10 v2025.1000.4047 in a controlled environment.
2. Set up a listener on an internal network (e.g., a simple HTTP server on port 8080).
3. Log in to the admin panel and navigate to the Collection Custom Interface feature.

Exploitation Steps:

1. In the custom URL field, enter: http://127.0.0.1:8080/secret.txt
2. Submit the form.
3. Observe that the server fetches the content from the internal server and displays it.

Advanced Exploitation:

• Use the SSRF to scan internal ports by iterating through URLs like http://192.168.1.1:22, http://192.168.1.1:80, etc.
• Access cloud metadata endpoints: http://169.254.169.254/latest/meta-data/
• Exploit internal services like Redis or Memcached.

Blue Team

Detection:

• Monitor outbound HTTP requests from the maccms10 server to unexpected internal IP addresses.
• Look for requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) in web server logs.
• Alert on URLs containing 169.254.169.254 or other cloud metadata endpoints.

Mitigation:

• Implement strict URL whitelisting in the Collection Custom Interface.
• Use a proxy or firewall to block outbound requests to private IP ranges.
• Apply network segmentation to limit the impact of SSRF.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to private IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 127.0.0.1).
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254).
  • Unusual port scanning patterns from the maccms10 server.

• File IOCs:

  • Log entries in access.log or error.log containing internal IP addresses.
  • Temporary files created by the application containing internal service responses.

• Behavioral IOCs:

  • Unexpected increase in outbound HTTP traffic from the maccms10 server.
  • Admin user accounts creating custom collection URLs pointing to internal resources.

Detection Engineering

YARA Rule

rule CVE_2025_28090_SSRF_Maccms10 {
    meta:
        description = "Detects SSRF exploitation attempts in maccms10 logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28090"
    strings:
        $ssrf1 = "169.254.169.254" ascii wide nocase
        $ssrf2 = "127.0.0.1" ascii wide nocase
        $ssrf3 = "10." ascii wide nocase
        $ssrf4 = "192.168." ascii wide nocase
        $ssrf5 = "172.16." ascii wide nocase
        $ssrf6 = "localhost" ascii wide nocase
    condition:
        any of ($ssrf*) and filesize < 10MB
}

Sigma Rule

title: SSRF Attempt Against Maccms10 Collection Custom Interface
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts targeting internal IPs via maccms10 custom collection URLs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'custom_url'
        c-ip|startswith:
            - '10.'
            - '172.16.'
            - '192.168.'
            - '127.'
    condition: selection
falsepositives:
    - Legitimate use of internal APIs if whitelisted
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28090 Maccms10 SSRF Attempt"; flow:to_server,established; content:"custom_url"; http_client_body; pcre:"/(169\.254\.169\.254|127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Collection Custom Interface if not essential for business operations.
2. Apply strict input validation – Only allow URLs from a predefined whitelist of trusted domains.
3. Implement network-level controls – Use a web application firewall (WAF) to block requests to private IP ranges.
4. Upgrade – Monitor the vendor for a patch and apply it as soon as available.

Long-term Measures:

• Conduct a security audit of all custom features in maccms10.
• Implement a Content Security Policy (CSP) to restrict outbound connections.
• Use a reverse proxy to sanitize and validate all incoming requests.

Workaround:

• Modify the application code to use a URL validation function that rejects private IPs and loopback addresses.

Valters IT