CVE-2025-51058
📋 TL;DR
Bottinelli Informatical Vedo Suite 2024.17 has a Server-side Request Forgery (SSRF) vulnerability in its /api_vedo/video/preview endpoint. Remote authenticated attackers can exploit this to make the server send HTTP requests to arbitrary internal or external systems. This affects all installations running the vulnerable version.
💻 Affected Systems
- Bottinelli Informatical Vedo Suite
📦 What is this software?
Vedo Suite by Vedo Suite Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, or pivot to other systems by making the vulnerable server proxy requests to internal network resources.
Likely Case
Information disclosure from internal services, potential data exfiltration, or scanning of internal network segments.
If Mitigated
Limited to authenticated users only, with network segmentation preventing access to critical internal systems.
🎯 Exploit Status
Exploit code is publicly available on GitHub. Requires authenticated access to the Vedo Suite application.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.18 or later
Vendor Advisory: http://bottinelli.com
Restart Required: No
Instructions:
1. Check current version. 2. Download and install the latest version from Bottinelli's official website. 3. Verify the patch is applied by checking the version number.
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from the Vedo Suite server to only necessary destinations.
Input Validation
allImplement WAF rules or application-level validation to block SSRF attempts in the file parameter.
🧯 If You Can't Patch
- Implement strict network segmentation to limit the Vedo server's outbound connections.
- Monitor and alert on suspicious outbound HTTP requests from the Vedo server.
🔍 How to Verify
Check if Vulnerable:
Check if the application version is 2024.17 and test the /api_vedo/video/preview endpoint with SSRF payloads in the file parameter.Check Version:
Check the application's admin interface or configuration files for version information.Verify Fix Applied:
Verify the application version is 2024.18 or later and test that SSRF payloads no longer work.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from the Vedo server
- Requests to internal IP addresses or unusual domains in access logs
Network Indicators:
- HTTP traffic from Vedo server to unexpected internal or external destinations
SIEM Query:
source="vedo-server" AND (dest_ip IN [internal_ranges] OR dest_domain NOT IN [allowed_domains])