CVE-2025-13789
📋 TL;DR
This CVE describes a server-side request forgery (SSRF) vulnerability in ZenTao's AI module. Attackers can exploit the makeRequest function in module/ai/model.php to make the server send unauthorized requests to internal or external systems. All ZenTao installations up to version 21.7.6-8564 are affected.
💻 Affected Systems
- ZenTao
📦 What is this software?
Zentao by Zentao
⚠️ Risk & Real-World Impact
Worst Case
Attackers could pivot to internal systems, access cloud metadata services, perform port scanning, or exfiltrate sensitive data from internal services.
Likely Case
Unauthorized access to internal HTTP services, potential data leakage from internal APIs, or abuse of the server as a proxy for malicious requests.
If Mitigated
Limited impact with proper network segmentation, egress filtering, and web application firewalls blocking suspicious outbound requests.
🎯 Exploit Status
Exploit details are publicly available in GitHub issues. Attack requires some level of access to the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 21.7.6
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Backup your ZenTao installation and database
2. Download ZenTao version 21.7.6 or later from official sources
3. Follow ZenTao upgrade documentation for your deployment method
4. Verify the upgrade completed successfully
🔧 Temporary Workarounds
Disable AI Module
allTemporarily disable or restrict access to the vulnerable AI module
# Modify ZenTao configuration to disable AI module
# Or use web server rules to block access to /module/ai/ paths
Network Egress Filtering
linuxImplement outbound firewall rules to restrict server-initiated HTTP requests
# Example iptables rule to block outbound HTTP from web server
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate ZenTao from internal services
- Deploy a web application firewall with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check ZenTao version in admin panel or by examining version files. If version is 21.7.6-8564 or earlier, system is vulnerable.Check Version:
Check ZenTao web interface admin panel or examine VERSION file in installation directoryVerify Fix Applied:
Verify ZenTao version shows 21.7.6 or later. Test the AI module functionality to ensure it works without allowing SSRF.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from web server process
- Requests to internal IP addresses or cloud metadata endpoints from web application
- Multiple failed connection attempts to various ports from web server
Network Indicators:
- Web server making unexpected HTTP requests to internal networks
- Traffic to cloud metadata services (169.254.169.254, etc.) from web server
SIEM Query:
source="web_server_logs" AND (dest_ip IN private_ranges OR dest_ip=169.254.169.254) AND user_agent="ZenTao"🔗 References
- https://github.com/ez-lbz/ez-lbz.github.io/issues/2
- https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issue-3598317459
- https://github.com/ez-lbz/ez-lbz.github.io/issues/2#issuecomment-3540247346
- https://vuldb.com/?ctiid.333793
- https://vuldb.com/?id.333793
- https://vuldb.com/?submit.690728
- https://www.zentao.net/extension-viewext-6.html
