CVE-2025-14518
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in PowerJob's network request handler. Attackers can manipulate targetIp/targetPort parameters to make the server send unauthorized requests to internal systems. All PowerJob deployments up to version 5.1.2 are affected.
💻 Affected Systems
- PowerJob
📦 What is this software?
Powerjob by Powerjob
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other internal systems through the compromised PowerJob server.
Likely Case
Unauthorized access to internal HTTP/HTTPS services, potential data leakage from internal APIs or management interfaces.
If Mitigated
Limited to accessing only allowed network segments if proper network segmentation and egress filtering are implemented.
🎯 Exploit Status
Exploit is publicly available in GitHub issues and requires minimal technical skill to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.1.3 or later
Vendor Advisory: https://github.com/PowerJob/PowerJob/issues/1144
Restart Required: Yes
Instructions:
1. Upgrade PowerJob to version 5.1.3 or later. 2. Restart the PowerJob service. 3. Verify the fix by checking the version.
🔧 Temporary Workarounds
Network Segmentation
allRestrict PowerJob server's outbound network access to only necessary internal services
Input Validation
allImplement additional input validation for targetIp/targetPort parameters
🧯 If You Can't Patch
- Implement strict network egress filtering to limit PowerJob server's outbound connections
- Deploy PowerJob in isolated network segments with no access to sensitive internal systems
🔍 How to Verify
Check if Vulnerable:
Check PowerJob version - if it's 5.1.2 or earlier, it's vulnerable.Check Version:
Check application logs or configuration files for PowerJob version informationVerify Fix Applied:
Verify PowerJob version is 5.1.3 or later and test SSRF attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound connection attempts from PowerJob server
- SSRF payload patterns in request logs
Network Indicators:
- PowerJob server making unexpected HTTP requests to internal IPs
- Unusual traffic patterns from PowerJob to non-standard ports
SIEM Query:
source_ip=PowerJob_server AND (dest_ip=internal_range OR dest_port!=standard_ports)🔗 References
- https://github.com/PowerJob/PowerJob/
- https://github.com/PowerJob/PowerJob/issues/1144
- https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002
- https://vuldb.com/?ctiid.335856
- https://vuldb.com/?id.335856
- https://vuldb.com/?submit.702896
- https://github.com/PowerJob/PowerJob/issues/1144
- https://github.com/PowerJob/PowerJob/issues/1144#issue-3673393002
