CVE-2025-15104
📋 TL;DR
The Nu Html Checker (validator.nu) contains a server-side request forgery (SSRF) vulnerability that allows attackers to bypass hostname-based protections and make the server perform HTTP/HTTPS requests to internal resources, including localhost services. This affects all deployments of the Nu Html Checker web service, particularly those exposed to untrusted users who can submit HTML for validation.
💻 Affected Systems
- Nu Html Checker (validator.nu)
📦 What is this software?
Validator by Validator
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access sensitive internal services, retrieve credentials from metadata services, interact with internal APIs, or perform reconnaissance on internal network segments.
Likely Case
Information disclosure from internal services, enumeration of internal network resources, or limited interaction with unprotected internal APIs.
If Mitigated
Limited impact if network segmentation prevents access to sensitive services and internal services require authentication.
🎯 Exploit Status
Exploitation requires DNS rebinding techniques or control of domains that resolve to loopback addresses, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/validator/validator
Restart Required: No
Instructions:
Monitor the GitHub repository for security updates. Consider implementing network-level controls as workarounds until a patch is available.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict the validator service's network access to prevent outbound connections to internal resources
iptables -A OUTPUT -p tcp --dport 80 -j DROP
iptables -A OUTPUT -p tcp --dport 443 -j DROP
DNS Filtering
allBlock DNS resolution to localhost and internal IP ranges at the network level
🧯 If You Can't Patch
- Isolate the validator service in a restricted network segment with no access to internal resources
- Implement strict egress filtering to only allow necessary outbound connections from the validator service
🔍 How to Verify
Check if Vulnerable:
Test if the validator service can be made to request internal resources by submitting HTML with specially crafted URLs that bypass hostname checksCheck Version:
Check the validator service version or commit hash if running from sourceVerify Fix Applied:
Verify that the validator service rejects or cannot reach internal resources when attempting SSRF attacks📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP/HTTPS requests from validator service to internal IP addresses
- Multiple validation requests with similar URL patterns
Network Indicators:
- HTTP requests from validator service to localhost/127.0.0.1 or internal network ranges
- DNS queries for domains that resolve to loopback addresses
SIEM Query:
source="validator-service" AND (dest_ip=127.0.0.1 OR dest_ip=::1 OR dest_ip IN [10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16])