CVE-2025-28096
📋 TL;DR
OneNav 1.1.0 contains a Server-Side Request Forgery (SSRF) vulnerability in custom headers functionality. This allows attackers to make unauthorized requests from the server to internal or external systems. All users running OneNav 1.1.0 are affected.
💻 Affected Systems
- OneNav
📦 What is this software?
Onenav by Onenav
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other systems within the network.
Likely Case
Information disclosure from internal services, potential data exfiltration, or scanning of internal network resources.
If Mitigated
Limited impact if network segmentation restricts server outbound connections and internal service access.
🎯 Exploit Status
Exploitation requires access to the custom headers functionality; references indicate detailed technical analysis is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Monitor the OneNav project for updates and apply when released.
🔧 Temporary Workarounds
Disable custom headers functionality
allRemove or disable the vulnerable custom headers feature in OneNav configuration.
Edit OneNav configuration to disable custom headers functionality
Network restrictions
allImplement egress filtering to restrict the OneNav server from making outbound requests to unauthorized destinations.
Configure firewall rules to block outbound HTTP/HTTPS from OneNav server except to required services
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the OneNav server from sensitive internal systems
- Deploy a web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running OneNav version 1.1.0 and if custom headers functionality is enabled.Check Version:
Check OneNav configuration or admin interface for version informationVerify Fix Applied:
Verify that custom headers functionality is disabled or that the server cannot make unauthorized outbound requests.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the OneNav server
- Requests to internal IP addresses or unusual domains
Network Indicators:
- HTTP requests from OneNav server to unexpected destinations
- Port scanning activity originating from the server
SIEM Query:
source_ip="[OneNav_Server_IP]" AND (dest_port=80 OR dest_port=443) AND dest_ip NOT IN [allowed_destinations]