CVE-2025-10211
📋 TL;DR
This is a Server-Side Request Forgery (SSRF) vulnerability in ChanCMS 3.3.0 that allows attackers to manipulate the taskUrl parameter to make the server send unauthorized requests to internal or external systems. The vulnerability affects all ChanCMS 3.3.0 installations with the vulnerable component enabled. Attackers can exploit this remotely without authentication.
💻 Affected Systems
- yanyutao0402 ChanCMS
📦 What is this software?
Chancms by Chancms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to internal networks by making the server request internal resources like metadata services, databases, or administrative interfaces.
Likely Case
Attackers will scan for vulnerable instances and attempt to access cloud metadata services, internal APIs, or use the server as a proxy for attacks against other systems.
If Mitigated
With proper network segmentation and input validation, the impact is limited to the server making unauthorized external requests, which could still lead to data leakage or reputation damage.
🎯 Exploit Status
Proof of concept is publicly available on GitHub. The exploit requires manipulating the taskUrl parameter to trigger SSRF.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: UNKNOWN
Vendor Advisory: NONE
Restart Required: No
Instructions:
No official patch is available as the vendor did not respond. Consider upgrading to a newer version if available, or apply workarounds.
🔧 Temporary Workarounds
Disable vulnerable endpoint
allBlock or disable access to the /cms/collect/getArticle endpoint
# Add to web server configuration (example for Apache):
<Location "/cms/collect/getArticle">
Order deny,allow
Deny from all
</Location>
# For Nginx:
location /cms/collect/getArticle {
deny all;
return 403;
}
Input validation filter
allImplement strict input validation for the taskUrl parameter to only allow expected URLs
# In application code, validate taskUrl before processing:
# Only allow specific domains or patterns
# Reject internal IP addresses, localhost, and metadata services
🧯 If You Can't Patch
- Implement network segmentation to restrict the server's outbound connections to only necessary services
- Deploy a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests
🔍 How to Verify
Check if Vulnerable:
Test if the /cms/collect/getArticle endpoint accepts arbitrary URLs in the taskUrl parameter and makes external requestsCheck Version:
Check CMS version in admin panel or configuration filesVerify Fix Applied:
Verify that the endpoint is no longer accessible or properly validates input by testing with malicious URLs📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the server to internal IPs or metadata services
- Multiple requests to /cms/collect/getArticle with varying taskUrl parameters
Network Indicators:
- Server making unexpected HTTP requests to internal network ranges or cloud metadata endpoints
SIEM Query:
source_ip=[server_ip] AND (dest_ip IN [internal_ranges] OR dest_host LIKE "*.metadata.*") AND http_method=GET