CVE-2025-6517
📋 TL;DR
This critical Server-Side Request Forgery (SSRF) vulnerability in Dromara MaxKey allows attackers to manipulate the Meta URL Handler to make unauthorized requests from the server. Attackers can potentially access internal systems, exfiltrate data, or perform other malicious actions. All MaxKey deployments up to version 4.1.7 are affected.
💻 Affected Systems
- Dromara MaxKey
📦 What is this software?
Maxkey by Maxkey
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, exfiltrate sensitive data, pivot to internal networks, or perform denial-of-service attacks against internal systems.
Likely Case
Attackers will scan for and exploit this vulnerability to access internal APIs, cloud metadata services, or other internal resources accessible from the MaxKey server.
If Mitigated
With proper network segmentation and egress filtering, impact is limited to what the server can access within its allowed network boundaries.
🎯 Exploit Status
Exploit details are publicly available in GitHub repositories. Remote exploitation is possible without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Monitor MaxKey GitHub repository for security updates
2. Apply any available patches for versions above 4.1.7
3. Restart MaxKey service after patching
🔧 Temporary Workarounds
Network Segmentation
allRestrict outbound network access from MaxKey servers to only required destinations
Input Validation
allImplement strict URL validation for the Meta URL Handler parameter
🧯 If You Can't Patch
- Implement strict egress filtering to limit what the MaxKey server can access
- Deploy a WAF with SSRF protection rules in front of MaxKey
🔍 How to Verify
Check if Vulnerable:
Check MaxKey version. If version is 4.1.7 or lower, the system is vulnerable.Check Version:
Check MaxKey application properties or deployment manifest for version informationVerify Fix Applied:
Verify MaxKey version is above 4.1.7 and test the Meta URL Handler endpoint with SSRF payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual outbound HTTP requests from MaxKey server
- Requests to internal IP addresses or cloud metadata services
Network Indicators:
- Unexpected outbound connections from MaxKey server to internal systems
SIEM Query:
source="maxkey" AND (url="169.254.169.254" OR url="metadata.google.internal" OR url="169.254.170.2")🔗 References
- https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md
- https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md#vulnerability-verification
- https://vuldb.com/?ctiid.313637
- https://vuldb.com/?id.313637
- https://vuldb.com/?submit.593111
- https://github.com/honorseclab/vulns/blob/main/dromara_MaxKey/SSRF.md
