CVE-2025-45475

Executive Summary

CVE-2025-45475 identifies a Server-Side Request Forgery (SSRF) vulnerability in Maccms10 version v2025.1000.4047, specifically within the Friend Link Management module. This flaw allows an authenticated attacker with low privileges to craft requests that force the server to make arbitrary HTTP requests to internal or external resources. The vulnerability can lead to internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints (e.g., AWS, GCP, Azure), bypassing firewall restrictions. No public exploit code or patch is currently available, making this a high-priority issue for organizations using Maccms10.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD; estimated based on vector)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires authenticated user with Friend Link management access
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited information disclosure
• Integrity Impact: Low (I:L) – potential to modify internal state via SSRF
• Availability Impact: None (A:N)
• Threat Level: Medium-High. While the CVSS base is moderate, the lack of a patch and the potential for internal network pivoting elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the Friend Link Management functionality of Maccms10. The application likely accepts a URL input for a friend link (e.g., a logo URL or link address) and fetches it server-side to validate or display it. Due to insufficient input validation and lack of URL whitelisting, an attacker can inject arbitrary URLs, including internal IP addresses (e.g., http://127.0.0.1:8080/admin, http://169.254.169.254/latest/meta-data/).

Attack Flow:

1. Attacker logs into Maccms10 with low-privileged credentials.
2. Navigates to Friend Link Management (e.g., /admin/friendlink/add).
3. Injects a malicious URL in the link field, such as http://192.168.1.1:80 or file:///etc/passwd.
4. The server processes the request, making an HTTP request to the attacker-specified target.
5. The response (or lack thereof) is reflected back to the attacker, enabling information gathering.

Root Cause: The application uses a function like file_get_contents() or curl_exec() without restricting the URL scheme or destination IP range. No validation is performed to block private IP ranges (RFC 1918) or loopback addresses.

Vulnerable vs. Patched Code

Vulnerable Code (Maccms10 v2025.1000.4047):

// Example vulnerable function in friendlink.php
function checkFriendLink($url) {
    $ch = curl_init($url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    curl_close($ch);
    return $response;
}

The above code directly uses user-supplied $url without any validation.

Patched Code (Hypothetical):

function checkFriendLink($url) {
    // Validate URL scheme
    $allowedSchemes = ['http', 'https'];
    $parsedUrl = parse_url($url);
    if (!in_array($parsedUrl['scheme'], $allowedSchemes)) {
        return false;
    }
    // Block private IP ranges
    $host = gethostbyname($parsedUrl['host']);
    if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        $ch = curl_init($url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        $response = curl_exec($ch);
        curl_close($ch);
        return $response;
    }
    return false;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Environment:

• Target: Maccms10 v2025.1000.4047 running on Apache/Nginx with PHP 7.4+
• Attacker: Kali Linux with Burp Suite or curl

Step-by-Step Exploitation:

1. Authenticate to Maccms10 admin panel (e.g., http://target.com/admin).
2. Navigate to Friend Link Management → Add Friend Link.
3. Intercept the request with Burp Suite.
4. Modify the link_url parameter to an internal resource:

   POST /admin/friendlink/add HTTP/1.1
   Host: target.com
   Cookie: PHPSESSID=attacker_session
   Content-Type: application/x-www-form-urlencoded
   
   link_name=test&link_url=http://169.254.169.254/latest/meta-data/&submit=1
   

5. Observe the response for cloud metadata or error messages indicating a successful connection.

Advanced Payloads:

• Port scan internal network: http://192.168.1.1:22, http://192.168.1.1:3306
• Access local files (if file:// is allowed): file:///etc/passwd
• Blind SSRF to internal services: http://127.0.0.1:8080/admin

Blue Team (Detection & Defense)

Detection:

• Monitor outbound HTTP requests from the Maccms10 server to unexpected IPs (especially private ranges).
• Look for anomalous link_url parameters containing IP addresses or unusual schemes.
• Use the Sigma rule below to detect SSRF attempts in web logs.

Defense:

• Immediately restrict outbound internet access from the Maccms10 server.
• Implement a Web Application Firewall (WAF) rule to block requests with private IPs in URL parameters.
• Apply the hypothetical patch above or disable the Friend Link Management feature until a patch is released.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the Maccms10 server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to cloud metadata endpoints (169.254.169.254, 100.100.100.200).
• File IOCs:
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log containing link_url=http:// followed by an IP address.
• Behavioral IOCs:
  • Unusual latency in Friend Link Management operations due to internal network timeouts.
  • Multiple failed connection attempts to internal services from the Maccms10 process.

Detection Engineering

YARA Rule

rule CVE_2025_45475_SSRF_Maccms10 {
    meta:
        description = "Detects SSRF attempts in Maccms10 Friend Link Management"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45475"
    strings:
        $ssrf_pattern1 = /link_url=http:\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/
        $ssrf_pattern2 = /link_url=file:\/\//
        $ssrf_pattern3 = /link_url=dict:\/\//
    condition:
        any of them
}

Sigma Rule

title: Maccms10 SSRF Attempt via Friend Link Management
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts in Maccms10 Friend Link Management by monitoring for private IP addresses in link_url parameters.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-45475
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'link_url=http://127.'
            - 'link_url=http://10.'
            - 'link_url=http://172.16.'
            - 'link_url=http://172.17.'
            - 'link_url=http://172.18.'
            - 'link_url=http://172.19.'
            - 'link_url=http://172.20.'
            - 'link_url=http://172.21.'
            - 'link_url=http://172.22.'
            - 'link_url=http://172.23.'
            - 'link_url=http://172.24.'
            - 'link_url=http://172.25.'
            - 'link_url=http://172.26.'
            - 'link_url=http://172.27.'
            - 'link_url=http://172.28.'
            - 'link_url=http://172.29.'
            - 'link_url=http://172.30.'
            - 'link_url=http://172.31.'
            - 'link_url=http://192.168.'
            - 'link_url=http://169.254.'
    condition: selection
falsepositives:
    - Legitimate use of internal URLs for friend links (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-45475 Maccms10 SSRF Attempt"; flow:to_server,established; content:"link_url="; http_client_body; pcre:"/link_url=http:\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Friend Link Management feature in Maccms10 until a patch is available.
   • Restrict outbound internet access from the Maccms10 server using a firewall or egress proxy.
   • Implement a WAF rule to block URL parameters containing private IP addresses.

2. Long-term Fix:

   • Apply the hypothetical patch provided in the "Vulnerable vs. Patched Code" section.
   • Monitor the vendor's website for an official patch and apply it as soon as it is released.
   • Conduct a security audit of all input handling functions in Maccms10.

3. Detection:

   • Deploy the YARA, Sigma, and Suricata rules provided in the Detection Engineering section.
   • Enable logging of all HTTP requests and monitor for SSRF patterns.

4. Workaround:

   • If the feature is critical, implement a whitelist of allowed external domains for friend links and reject all IP-based URLs.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert