CVE-2025-28093

Executive Summary

CVE-2025-28093 identifies a Server-Side Request Forgery (SSRF) vulnerability in ShopXO v6.4.0, specifically within the Email Settings functionality. An authenticated attacker with administrative privileges can manipulate the SMTP server configuration to force the application server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS, GCP), or other internal services that are not intended to be exposed. The vulnerability is currently unpatched, and no public exploit code is available. The CVSS score is 0.0 in the NVD data, but based on the SSRF nature, a more realistic score is provided in the CVSS Breakdown section.

Supply Chain & Package Security

ShopXO is a PHP-based open-source e-commerce platform. The vulnerability resides in the core application code, not in a third-party package. However, administrators should verify the integrity of their ShopXO installation and ensure no malicious modifications have been made to the email configuration files.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs admin-level access to the ShopXO admin panel.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – SSRF can expose sensitive internal data.
• Integrity (I): None – No data modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High (7.5) – SSRF can lead to internal network compromise.

Deep Dive & Mechanics

The vulnerability exists in the email settings configuration page (/admin/index/index.html or similar). The application allows an admin to configure SMTP server details, including the SMTP host, port, and authentication credentials. The flaw is that the application does not properly validate or sanitize the SMTP host field. An attacker can input a URL or IP address pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata). When the application attempts to test the SMTP connection or send a test email, it will make an HTTP request to the attacker-controlled host, effectively performing an SSRF attack.

Attack Flow:

1. Attacker gains admin credentials (e.g., via phishing, weak password, or other means).
2. Attacker logs into ShopXO admin panel.
3. Attacker navigates to Email Settings.
4. Attacker sets the SMTP host to an internal IP or URL (e.g., http://169.254.169.254).
5. Attacker clicks "Test Connection" or "Send Test Email".
6. The server makes an HTTP request to the specified host.
7. The response (if any) is reflected back to the attacker, revealing internal data.

Vulnerable vs. Patched Code

Vulnerable Code (ShopXO v6.4.0): The vulnerable code is likely in a PHP file handling email configuration, such as app/admin/controller/Email.php or similar. The code directly uses the user-supplied SMTP host in a fsockopen() or curl_exec() call without validation.

// Vulnerable example
$smtp_host = input('post.smtp_host');
$smtp_port = input('post.smtp_port');
$fp = fsockopen($smtp_host, $smtp_port, $errno, $errstr, 30);

Patched Code (Hypothetical): A patch would validate that the SMTP host is a valid hostname or IP address and not a URL, and would block private IP ranges.

// Patched example
$smtp_host = input('post.smtp_host');
if (filter_var($smtp_host, FILTER_VALIDATE_URL)) {
    // Reject URLs
    throw new Exception('Invalid SMTP host');
}
if (filter_var($smtp_host, FILTER_VALIDATE_IP) && !filter_var($smtp_host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    // Reject private/reserved IPs
    throw new Exception('Invalid SMTP host');
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for ShopXO.
• Network access to the ShopXO admin panel.

Steps:

1. Log in to ShopXO admin panel.
2. Navigate to System -> Email Settings.
3. In the "SMTP Server" field, enter an internal URL, e.g., http://169.254.169.254/latest/meta-data/.
4. Set the SMTP port to 80 (or 443 for HTTPS).
5. Click "Test Connection".
6. Observe the response. If the server returns data, the SSRF is successful.

Example Payloads:

• http://169.254.169.254/latest/meta-data/ (AWS metadata)
• http://metadata.google.internal/computeMetadata/v1/ (GCP metadata)
• http://127.0.0.1:8080/admin (internal admin interface)
• file:///etc/passwd (if the application supports file:// protocol)

Blue Team

Detection:

• Monitor outbound HTTP requests from the ShopXO server to unexpected IPs (especially private IPs).
• Alert on admin login attempts from unusual IPs.
• Monitor changes to email configuration files.

Hunting:

• Search logs for smtp_host parameter containing URLs or private IPs.
• Look for fsockopen() or curl_exec() calls with suspicious parameters.

Lab Setup:

• Deploy a vulnerable ShopXO v6.4.0 instance in an isolated environment.
• Use a tool like nc -lvp 80 to simulate an internal listener.
• Execute the attack and capture the request.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
  • Requests to cloud metadata endpoints (169.254.169.254, metadata.google.internal).
  • Unusual SMTP traffic on non-standard ports (e.g., 80, 443).

• File IOCs:

  • Modified email configuration files (e.g., config/email.php).
  • Suspicious entries in web server logs (e.g., POST /admin/index/index.html with smtp_host parameter).

• Behavioral IOCs:

  • Admin user performing multiple "Test Connection" actions in a short time.
  • Admin user accessing email settings from an unusual IP.

Detection Engineering

YARA Rule

rule CVE_2025_28093_SSRF_ShopXO {
    meta:
        description = "Detects SSRF exploitation attempts in ShopXO email settings"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-28093"
    strings:
        $smtp_host = "smtp_host" nocase
        $test_connection = "Test Connection" nocase
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
        $url_pattern = /http[s]?:\/\/[^\s]+/
    condition:
        all of ($smtp_host, $test_connection) and ($private_ip or $url_pattern)
}

Sigma Rule

title: CVE-2025-28093 SSRF in ShopXO Email Settings
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts via email settings in ShopXO
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28093
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/index/index.html'
        cs-uri-query|contains: 'smtp_host'
    keywords:
        - '169.254.169.254'
        - 'metadata.google.internal'
        - '10.'
        - '172.16.'
        - '192.168.'
    condition: selection and keywords
falsepositives:
    - Legitimate internal SMTP servers
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-28093 SSRF in ShopXO Email Settings"; flow:to_server,established; content:"POST"; http_method; content:"/admin/index/index.html"; http_uri; content:"smtp_host"; http_client_body; pcre:"/(169\.254\.169\.254|metadata\.google\.internal|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Admin Access: Limit admin panel access to trusted IPs only.
2. Disable Email Test Feature: If not required, disable the "Test Connection" functionality.
3. Network Segmentation: Ensure the ShopXO server cannot reach internal metadata endpoints.

Long-term Fix:

• Apply input validation to the SMTP host field (block URLs and private IPs).
• Use a whitelist of allowed SMTP servers.
• Implement a patch from the vendor when available.

Workaround:

• Modify the PHP code to validate the SMTP host using filter_var() with FILTER_VALIDATE_DOMAIN and block private IPs.

Valters IT