CVE-2025-52454

Executive Summary

CVE-2025-52454 is a Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server, specifically affecting the Amazon S3 Connector modules on both Windows and Linux platforms. This flaw allows an attacker to spoof resource locations, potentially leading to unauthorized access to internal systems, data exfiltration, or further lateral movement within the network. The vulnerability impacts Tableau Server versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, given the critical nature of SSRF vulnerabilities and the widespread use of Tableau Server in enterprise environments, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side issue within the Salesforce Tableau Server software itself.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or unassigned. Based on the vulnerability type (SSRF) and the potential impact, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - An attacker may need some level of access to trigger the SSRF, but not necessarily administrative.
• User Interaction (UI): None (N)
• Scope (S): Changed (C) - The SSRF can be used to attack resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Potential to read internal resources.
• Integrity (I): Low (L) - May be able to modify internal resources.
• Availability (A): Low (L) - Could cause denial of service to internal systems.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L Estimated Base Score: 8.5 (High)

Deep Dive & Mechanics

The vulnerability resides in the Amazon S3 Connector modules of Tableau Server. When Tableau Server is configured to connect to Amazon S3 for data sources, the connector processes URLs or resource identifiers provided by the user or from external data. Due to insufficient validation, an attacker can craft a malicious request that causes the server to make HTTP requests to arbitrary internal or external resources.

Mechanism:

1. An attacker with access to Tableau Server (e.g., a user with data source creation privileges) submits a request to create or modify an S3 connection.
2. The request includes a specially crafted URL or resource identifier that points to an internal IP address (e.g., http://169.254.169.254/latest/meta-data/) or a sensitive internal service.
3. The Tableau Server's S3 Connector module, without proper validation, makes an HTTP request to the attacker-specified URL.
4. The response from the internal resource is then returned to the attacker, potentially leaking sensitive information such as cloud metadata, internal service credentials, or configuration data.

This is a classic SSRF vulnerability that can be exploited to bypass firewalls and access internal networks from the server's perspective.

Vulnerable vs. Patched Code

Since no specific code snippets are provided, we can infer the general difference:

Vulnerable Code (Conceptual):

# Vulnerable S3 Connector code
def fetch_s3_data(url):
    # No validation of the URL
    response = requests.get(url)
    return response.text

Patched Code (Conceptual):

# Patched S3 Connector code
import re
from urllib.parse import urlparse

ALLOWED_HOSTS = ['s3.amazonaws.com', '*.s3.amazonaws.com', 's3.us-east-1.amazonaws.com']

def fetch_s3_data(url):
    parsed_url = urlparse(url)
    if not any(parsed_url.hostname.endswith(allowed) for allowed in ALLOWED_HOSTS):
        raise ValueError("Invalid S3 URL")
    # Additional validation: ensure no internal IPs
    if re.match(r'^10\.|^172\.(1[6-9]|2[0-9]|3[0-1])\.|^192\.168\.|^127\.|^0\.|^169\.254\.', parsed_url.hostname):
        raise ValueError("Internal IP not allowed")
    response = requests.get(url)
    return response.text

The patched version implements strict allowlisting of allowed S3 endpoints and blocks requests to internal IP ranges.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Lab Setup:

• Target: Tableau Server 2023.3.18 running on Linux with S3 Connector enabled.
• Attacker Machine: Kali Linux with network access to the Tableau Server.
• Internal Target: A simulated internal service (e.g., a web server on 192.168.1.100:8080) or cloud metadata endpoint.

Exploitation Steps:

1. Identify the S3 Connector endpoint: Typically, this is part of the Tableau Server REST API or web interface for data source creation.
2. Craft a malicious request: Use a tool like curl or Burp Suite to send a POST request to the data source creation endpoint with a manipulated S3 URL.

   curl -X POST https://tableau-server/api/3.12/sites/Default/datasources \
     -H "X-Tableau-Auth: <token>" \
     -d '{
       "datasource": {
         "name": "MaliciousDS",
         "connection": {
           "server": "http://169.254.169.254/latest/meta-data/",
           "dbname": "test"
         }
       }
     }'
   

3. Observe the response: If successful, the response will contain the internal metadata (e.g., IAM role credentials).
4. Escalate: Use the leaked credentials to access other cloud resources.

Blue Team (Defender) Perspective

Detection:

• Monitor for outbound HTTP requests from the Tableau Server to unexpected IP addresses, especially private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata IPs (169.254.169.254).
• Look for anomalous data source creation requests with URLs that do not match standard S3 patterns (e.g., *.s3.amazonaws.com).

Mitigation:

• Immediately apply the patch by upgrading to the fixed versions.
• Implement network segmentation to restrict the Tableau Server's outbound access.
• Use a web application firewall (WAF) to block requests containing private IP addresses in the URL.

Indicators of Compromise (IOCs)

• Network Traffic:
  • Outbound HTTP requests from Tableau Server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (AWS metadata endpoint).
  • Unusual User-Agent strings in outbound requests (e.g., "Tableau S3 Connector").
• Logs:
  • Tableau Server logs showing failed or successful connections to non-S3 endpoints.
  • Web server logs (if Tableau is behind a reverse proxy) showing requests with suspicious URLs.
• File System:
  • Temporary files or cached data containing internal IP addresses or cloud metadata.

Detection Engineering

YARA Rule

rule Detect_Tableau_SSRF_Attempt {
    meta:
        description = "Detects SSRF attempts targeting internal IPs in Tableau Server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52454"
    strings:
        $s1 = "169.254.169.254" nocase
        $s2 = "10." ascii
        $s3 = "192.168." ascii
        $s4 = "172.16." ascii
        $s5 = "172.17." ascii
        $s6 = "172.18." ascii
        $s7 = "172.19." ascii
        $s8 = "172.20." ascii
        $s9 = "172.21." ascii
        $s10 = "172.22." ascii
        $s11 = "172.23." ascii
        $s12 = "172.24." ascii
        $s13 = "172.25." ascii
        $s14 = "172.26." ascii
        $s15 = "172.27." ascii
        $s16 = "172.28." ascii
        $s17 = "172.29." ascii
        $s18 = "172.30." ascii
        $s19 = "172.31." ascii
        $s20 = "127.0.0.1" ascii
        $s21 = "localhost" nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Tableau Server SSRF Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects outbound HTTP requests from Tableau Server to internal IP addresses
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52454
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\tableau.exe'
        DestinationIp:
            - '10.*'
            - '172.16.*'
            - '172.17.*'
            - '172.18.*'
            - '172.19.*'
            - '172.20.*'
            - '172.21.*'
            - '172.22.*'
            - '172.23.*'
            - '172.24.*'
            - '172.25.*'
            - '172.26.*'
            - '172.27.*'
            - '172.28.*'
            - '172.29.*'
            - '172.30.*'
            - '172.31.*'
            - '192.168.*'
            - '127.*'
            - '169.254.*'
    condition: selection
falsepositives:
    - Legitimate internal network monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-52454 Tableau Server SSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"/latest/meta-data/"; http_uri; sid:1000001; rev:1;)
alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-52454 Tableau Server SSRF to Private IP"; flow:to_server; content:"GET"; http_method; pcre:"/^http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|127\.|169\.254\.)/"; sid:1000002; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 as applicable. This is the primary fix.
2. Network Segmentation: Place Tableau Server in a segmented network with strict egress controls. Only allow outbound connections to known S3 endpoints (e.g., *.s3.amazonaws.com).
3. Input Validation: If custom S3 connectors are used, implement strict URL validation to block private IPs and internal hostnames.
4. Web Application Firewall (WAF): Deploy a WAF to inspect and block requests containing private IP addresses or cloud metadata endpoints.
5. Monitoring: Enable detailed logging for all outbound HTTP requests from Tableau Server and alert on any anomalies.
6. Least Privilege: Ensure that the Tableau Server service account has minimal permissions and cannot access sensitive internal resources.

Valters IT
Securing Digital Frontiers