CVE-2025-10096
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in SimStudioAI sim software up to version 1.0.0. Attackers can manipulate the filePath parameter in the route.ts API endpoint to make the server send unauthorized requests to internal or external systems. All users running vulnerable versions of SimStudioAI sim are affected.
💻 Affected Systems
- SimStudioAI sim
📦 What is this software?
Sim by Sim
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other systems within the network.
Likely Case
Unauthorized access to internal APIs, metadata services, or file systems accessible from the server.
If Mitigated
Limited impact with proper network segmentation and input validation controls.
🎯 Exploit Status
Exploit has been publicly disclosed but no public PoC is confirmed. Attack requires remote access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in commit 3424a338b763115f0269b209e777608e4cd31785
Vendor Advisory: https://github.com/simstudioai/sim/commit/3424a338b763115f0269b209e777608e4cd31785
Restart Required: No
Instructions:
1. Update to the latest version of SimStudioAI sim. 2. Apply commit 3424a338b763115f0269b209e777608e4cd31785. 3. Verify the fix by testing the file parsing endpoint.
🔧 Temporary Workarounds
Input Validation
allImplement strict validation on the filePath parameter to reject malicious inputs.
Network Segmentation
allRestrict outbound network access from the vulnerable server to only necessary services.
🧯 If You Can't Patch
- Implement a Web Application Firewall (WAF) with SSRF protection rules.
- Monitor and block suspicious outbound requests from the server.
🔍 How to Verify
Check if Vulnerable:
Check if your version is 1.0.0 or earlier and if the vulnerable route.ts file exists.Check Version:
Check package.json or git log for version information.Verify Fix Applied:
Verify that commit 3424a338b763115f0269b209e777608e4cd31785 is applied in your codebase.📡 Detection & Monitoring
Log Indicators:
- Unusual filePath parameter values in API logs
- Outbound requests to unexpected internal/external IPs
Network Indicators:
- Suspicious outbound HTTP requests from the server to internal services
SIEM Query:
source="api.log" AND (filePath CONTAINS "http://" OR filePath CONTAINS "file://" OR filePath CONTAINS "://")