CVE-2025-14516
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in the Yalantis uCrop Android library version 2.2.11. The vulnerability allows attackers to make unauthorized requests from the vulnerable server to internal systems, potentially accessing sensitive data or services. Android applications using this vulnerable library version are affected.
💻 Affected Systems
- Yalantis uCrop Android library
📦 What is this software?
Ucrop by Yalantis
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to attack other internal systems from the vulnerable server.
Likely Case
Information disclosure from internal services, potential access to cloud metadata services, or scanning of internal networks.
If Mitigated
Limited impact if network segmentation restricts outbound connections and internal services require authentication.
🎯 Exploit Status
Exploit details are publicly available and could be integrated into malicious apps or content.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
1. Check if your Android app uses uCrop 2.2.11
2. Monitor for vendor updates
3. Consider alternative libraries or implementing custom validation
🔧 Temporary Workarounds
Input validation and URL filtering
allImplement strict validation of URLs passed to uCrop functions, whitelist allowed domains, and block internal/private IP addresses.
Network restrictions
allConfigure network policies to restrict outbound connections from mobile apps to only necessary external services.
🧯 If You Can't Patch
- Implement application-level URL validation before passing to uCrop
- Use network segmentation to limit what internal services the vulnerable app can access
🔍 How to Verify
Check if Vulnerable:
Check your Android app's build.gradle or dependencies for 'com.yalantis.ucrop:ucrop:2.2.11'Check Version:
grep -r "com.yalantis.ucrop" build.gradle or check dependencies in Android StudioVerify Fix Applied:
Verify the library version has been updated to a patched version when available📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from mobile apps to internal IP ranges
- Requests to metadata services (169.254.169.254, etc.)
Network Indicators:
- HTTP requests from mobile apps to unexpected internal destinations
- Port scanning patterns from mobile app instances
SIEM Query:
source="mobile-app" AND dest_ip IN (RFC1918_ranges, localhost, metadata_services)🔗 References
- https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446
- https://mesquite-dream-86b.notion.site/uCrop-Library-SSRF-and-Intent-Spoofing-2b8512562197804dae69edf96b942446?pvs=25#039fe30a92dc4ed88c9b03f85418e92e
- https://vuldb.com/?ctiid.335854
- https://vuldb.com/?id.335854
- https://vuldb.com/?submit.702810
