CVE-2025-10391
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in CRMEB versions up to 5.6.1. Attackers can manipulate the push_token_url parameter in the testOutUrl function to make the server send unauthorized requests to internal or external systems. All CRMEB installations up to version 5.6.1 are affected.
💻 Affected Systems
- CRMEB
📦 What is this software?
Crmeb by Crmeb
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to internal network resources, potentially leading to full system compromise.
Likely Case
Attackers scan internal networks, access metadata services, or interact with internal APIs to gather information or perform limited actions.
If Mitigated
With proper network segmentation and input validation, impact is limited to the application server's network access scope.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. Attack requires access to the vulnerable function.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
Upgrade to a version beyond 5.6.1 if available. Since vendor hasn't responded, consider applying manual fixes or workarounds.
🔧 Temporary Workarounds
Input Validation and Sanitization
allAdd validation to ensure push_token_url parameter only accepts expected URLs and blocks internal IP ranges.
Modify app/services/out/OutAccountServices.php to validate URLs before processing
Network Segmentation
allRestrict outbound network access from the CRMEB server to only necessary external services.
Configure firewall rules to block outbound requests to internal IP ranges from CRMEB server
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block SSRF patterns
- Monitor outbound network traffic from CRMEB server for unusual requests
🔍 How to Verify
Check if Vulnerable:
Check if CRMEB version is 5.6.1 or earlier. Review app/services/out/OutAccountServices.php for the testOutUrl function.Check Version:
Check CRMEB version in system configuration or admin panelVerify Fix Applied:
Test if push_token_url parameter validation prevents requests to internal IPs or unexpected domains.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from CRMEB server
- Requests to internal IP addresses or metadata services
Network Indicators:
- Outbound HTTP requests from CRMEB server to unexpected destinations
- Requests to AWS metadata service (169.254.169.254) or similar
SIEM Query:
source_ip="CRMEB_SERVER_IP" AND dest_ip IN (RFC1918_RANGES, 169.254.169.254, 127.0.0.1)