CVE-2025-34228

Executive Summary

CVE-2025-34228 is a critical unauthenticated Server-Side Request Forgery (SSRF) vulnerability in Vasion Print (formerly PrinterLogic) Virtual Appliance and SaaS deployments. The flaw resides in the /var/www/app/console_release/lexmark/update.php script, which is reachable from the internet without authentication. The script constructs URLs from user-supplied values and passes them to curl_exec() or file_get_contents() without proper validation. This allows any remote attacker to force the server to make requests to internal resources, enabling internal network reconnaissance, potential pivoting, or data exfiltration. The vulnerability has been remediated in versions 25.1.102 (VA) and 25.1.1413 (SaaS), but the exact patch timeline is unclear.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise print management appliance. The supply chain risk is limited to the vendor's software distribution and update mechanisms.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – Likely unassigned or under review. Based on the description, a reasonable CVSSv3.1 vector is:
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Scope (S): Unchanged (U)
  • Confidentiality (C): High (H) – Internal network reconnaissance and data exfiltration possible.
  • Integrity (I): None (N)
  • Availability (A): None (N)
  • Base Score: 7.5 (High)
• Threat Level: High. The unauthenticated nature and potential for internal network scanning make this a serious risk for organizations using Vasion Print.

Deep Dive & Mechanics

The vulnerability is a classic SSRF in a PHP script. The endpoint /var/www/app/console_release/lexmark/update.php is exposed to the internet without authentication. The script accepts user-controlled parameters (likely hostname or similar) and constructs a URL. This URL is then passed to either curl_exec() (from PHP cURL) or file_get_contents() (PHP stream wrapper). Both functions will follow the URL and return the response.

Attack Flow:

1. Attacker identifies a Vasion Print instance (e.g., via Shodan dork title:"PrinterLogic").
2. Attacker sends a crafted HTTP request to /var/www/app/console_release/lexmark/update.php with a parameter pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
3. The server fetches the internal resource and returns the response to the attacker.
4. Attacker can iterate through internal IP ranges, ports, and services to map the internal network.

Why it works:

• No authentication check on the endpoint.
• No URL validation or allowlist.
• curl_exec() and file_get_contents() follow redirects and support various protocols (http, https, ftp, etc.).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
// /var/www/app/console_release/lexmark/update.php
$host = $_GET['hostname'];
$url = "http://" . $host . "/update";
$response = file_get_contents($url);
echo $response;
?>

Patched Code (Conceptual):

<?php
// /var/www/app/console_release/lexmark/update.php
$host = $_GET['hostname'];
// Validate hostname against an allowlist
$allowed_hosts = ['lexmark-update.example.com', '10.0.0.1'];
if (!in_array($host, $allowed_hosts)) {
    die('Invalid hostname');
}
$url = "http://" . $host . "/update";
$response = file_get_contents($url);
echo $response;
?>

The patch likely adds input validation, an allowlist of permitted hosts, and/or authentication requirements.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Vasion Print Virtual Appliance (version < 25.1.102) in a controlled environment.
2. Set up an internal web server (e.g., Apache on 192.168.1.100) to simulate internal resources.
3. Use a tool like Burp Suite or curl to send requests.

Exploitation Steps:

1. Identify the target: https://target-vasion-print.com/var/www/app/console_release/lexmark/update.php
2. Craft a request to probe internal network:

   curl -k "https://target-vasion-print.com/var/www/app/console_release/lexmark/update.php?hostname=192.168.1.100:80"
   

3. If the internal server responds, the attacker will see the response.
4. For AWS metadata:

   curl -k "https://target-vasion-print.com/var/www/app/console_release/lexmark/update.php?hostname=169.254.169.254/latest/meta-data/"
   

5. Use a tool like ssrfmap to automate scanning.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor web server logs for requests to /var/www/app/console_release/lexmark/update.php from external IPs.
• Look for unusual hostname parameters containing internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) or cloud metadata IPs (169.254.169.254).
• Alert on high volumes of requests to this endpoint with varying hostnames.

Hunting:

• Search for outbound connections from the Vasion Print server to internal IPs on unusual ports.
• Correlate with DNS queries for internal hostnames.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /var/www/app/console_release/lexmark/update.php with hostname parameter containing internal IPs.
  • Outbound connections from the Vasion Print server to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • DNS queries for internal hostnames from the Vasion Print server.
• File IOCs:
  • Log entries in /var/log/apache2/access.log or similar with the vulnerable endpoint.
• System IOCs:
  • Unexpected processes running curl or wget from the web server user.

Detection Engineering

YARA Rule

rule CVE_2025_34228_SSRF_VasionPrint {
    meta:
        description = "Detects exploitation attempts of CVE-2025-34228 SSRF in Vasion Print"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34228"
    strings:
        $endpoint = "/var/www/app/console_release/lexmark/update.php"
        $param = "hostname="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
        $metadata_ip = "169.254.169.254"
    condition:
        $endpoint and $param and ($internal_ip or $metadata_ip)
}

Sigma Rule

title: CVE-2025-34228 SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting the vulnerable Vasion Print endpoint with internal IPs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/var/www/app/console_release/lexmark/update.php"
        cs-uri-query|contains: "hostname="
    filter:
        cs-uri-query|contains:
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
            - "169.254.169.254"
    condition: selection and filter
falsepositives:
    - Legitimate internal updates (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-34228 Vasion Print SSRF Exploitation"; flow:to_server,established; content:"/var/www/app/console_release/lexmark/update.php"; http_uri; content:"hostname="; http_uri; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.169\.254)/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Vasion Print Virtual Appliance Host to version 25.1.102 or later, and Application to 25.1.1413 or later.
2. Workaround: If patching is not immediately possible, restrict access to the vulnerable endpoint using a Web Application Firewall (WAF) or reverse proxy. Block external access to /var/www/app/console_release/lexmark/update.php.
3. Network Segmentation: Ensure the Vasion Print server is isolated from sensitive internal networks. Use strict firewall rules to limit outbound connections from the server.

Long-term Mitigations:

• Implement input validation and allowlisting for all user-supplied URLs.
• Require authentication for all administrative endpoints.
• Conduct regular security audits and penetration testing.
• Monitor for SSRF patterns in web logs.

Valters IT Signature

Report generated by Valters IT DevSecOps & CTI Division