CVE-2025-10410
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in SourceCodester Link Status Checker 1.0 where manipulation of the 'proxy' parameter in index.php allows attackers to make unauthorized requests from the vulnerable server. The vulnerability affects all installations of Link Status Checker 1.0 and can be exploited remotely without authentication.
💻 Affected Systems
- SourceCodester Link Status Checker
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could use the vulnerable server as a proxy to scan internal networks, access internal services, or perform data exfiltration from systems reachable by the server.
Likely Case
Attackers will use the vulnerability to scan internal networks, access metadata services (like AWS/Azure instance metadata), or perform port scanning of internal systems.
If Mitigated
With proper network segmentation and egress filtering, the impact is limited to the server itself and directly adjacent systems.
🎯 Exploit Status
Public proof-of-concept exploit is available on GitHub. Exploitation requires only HTTP requests to the vulnerable parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://www.sourcecodester.com/
Restart Required: No
Instructions:
No official patch is available. Remove or disable the application until a fix is released.
🔧 Temporary Workarounds
Input Validation and Filtering
PHPImplement strict input validation on the proxy parameter to only allow expected values or disable the parameter entirely.
Modify index.php to validate proxy parameter: if(!filter_var($proxy, FILTER_VALIDATE_URL) || !in_array(parse_url($proxy, PHP_URL_HOST), $allowed_hosts)) { die('Invalid proxy'); }
Web Application Firewall Rules
allImplement WAF rules to block requests containing suspicious proxy parameters or SSRF patterns.
WAF rule to block: Contains 'proxy=' with internal IP patterns or localhost references
🧯 If You Can't Patch
- Remove the application from production systems immediately
- Implement network segmentation to restrict the server's outbound connections to only necessary services
🔍 How to Verify
Check if Vulnerable:
Test by sending a request to index.php with proxy parameter pointing to a controlled server (e.g., http://attacker.com/test) and check if the server makes the request.Check Version:
Check the application files for version information or review the source code for version markers.Verify Fix Applied:
Attempt the same SSRF test after implementing workarounds - the server should not make external requests.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the server, especially to internal IP ranges or metadata services
- Requests to index.php with proxy parameter containing unusual URLs
Network Indicators:
- Unexpected outbound HTTP traffic from the server to internal networks or external services
SIEM Query:
source="web_server_logs" AND uri="*index.php*" AND query="*proxy=*" AND (dst_ip="169.254.169.254" OR dst_ip="10.*" OR dst_ip="192.168.*" OR dst_ip="172.16.*")