CVE-2025-10096: SimStudioAI Sim SSRF Vulnerability

CVE-2025-10096 Overview

CVE-2025-10096 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting SimStudioAI sim versions up to 1.0.0. The flaw resides in the file parsing route handler at apps/sim/app/api/files/parse/route.ts, where manipulation of the filePath argument allows an authenticated remote attacker to coerce the server into issuing arbitrary outbound requests. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against unpatched deployments. The upstream project has issued fix commit 3424a338b763115f0269b209e777608e4cd31785 to remediate the issue.

Critical Impact
An authenticated attacker can leverage the vulnerable filePath parameter to make the application initiate requests to arbitrary internal or external hosts, potentially exposing metadata services, internal APIs, and non-public infrastructure.

Affected Products

SimStudioAI sim versions up to and including 1.0.0
Deployments exposing the apps/sim/app/api/files/parse/route.ts endpoint
Related proxy routes patched in the same commit (apps/sim/app/api/proxy/route.ts, apps/sim/app/api/proxy/image/route.ts)

Discovery Timeline

2025-09-08 - CVE-2025-10096 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10096

Vulnerability Analysis

The vulnerability exists in the SimStudioAI sim file parsing API route. The handler accepts a user-controlled filePath argument and uses it to fetch content without sufficient validation of the target URL. Because the request is issued by the server, an attacker can substitute URLs that reference internal-only resources, cloud metadata endpoints, or arbitrary third-party hosts. This class of flaw, classified under CWE-918: Server-Side Request Forgery, is common in applications that proxy or fetch remote content on behalf of users. The public disclosure of the technique lowers the bar for exploitation against exposed instances.

Root Cause

The root cause is missing URL validation on the filePath input consumed by the parse route. The application did not restrict the URL scheme, resolve and vet the destination host, or block requests to private, loopback, or link-local address ranges before dispatching the outbound request.

Attack Vector

Exploitation occurs over the network by an authenticated user submitting a crafted request to the file parse endpoint. The attacker supplies a filePath value pointing to an attacker-chosen URL, such as an internal service or a cloud provider instance metadata endpoint. The sim server then performs the request and may return the response body or side effects to the caller.

typescript

// Security patch applied to apps/sim/app/api/proxy/image/route.ts
 import { type NextRequest, NextResponse } from 'next/server'
 import { createLogger } from '@/lib/logs/console/logger'
+import { validateImageUrl } from '@/lib/security/url-validation'
 
 const logger = createLogger('ImageProxyAPI')

// Security patch applied to apps/sim/app/api/proxy/route.ts
 import { NextResponse } from 'next/server'
 import { isDev } from '@/lib/environment'
 import { createLogger } from '@/lib/logs/console/logger'
+import { validateProxyUrl } from '@/lib/security/url-validation'
 import { executeTool } from '@/tools'
 import { getTool, validateRequiredParametersAfterMerge } from '@/tools/utils'
// Source: https://github.com/simstudioai/sim/commit/3424a338b763115f0269b209e777608e4cd31785

The patch introduces centralized URL validation helpers (validateImageUrl, validateProxyUrl) from @/lib/security/url-validation that are invoked before any outbound fetch is performed.

Detection Methods for CVE-2025-10096

Indicators of Compromise

Outbound requests originating from the sim application host to internal RFC1918 addresses, 127.0.0.1, or 169.254.169.254.
HTTP requests to /api/files/parse containing filePath values referencing non-standard schemes such as file://, gopher://, or unexpected external hosts.
Unexpected responses in sim application logs containing content sourced from cloud metadata services or internal management interfaces.

Detection Strategies

Inspect web server and reverse proxy access logs for POST or GET traffic to /api/files/parse with abnormal or attacker-controlled filePath parameters.
Correlate egress firewall telemetry with sim process activity to identify server-initiated connections to unexpected destinations.
Deploy WAF rules that block requests to the parse route when the filePath argument resolves to private IP ranges or non-HTTP schemes.

Monitoring Recommendations

Enable egress filtering and log every outbound request initiated by the sim service, prioritizing alerts on private, loopback, and metadata-service destinations.
Baseline the domains and IP ranges the sim application legitimately contacts, then alert on deviations.
Monitor authentication logs for accounts making disproportionately high volumes of parse requests, which may indicate reconnaissance.

How to Mitigate CVE-2025-10096

Immediate Actions Required

Upgrade SimStudioAI sim to a release that includes commit 3424a338b763115f0269b209e777608e4cd31785 or later.
Restrict network egress from the sim application host, denying access to internal subnets and cloud instance metadata endpoints where not required.
Review recent access logs for exploitation attempts against /api/files/parse and rotate any credentials that could have been exposed via metadata service reads.

Patch Information

The upstream fix is delivered in commit 3424a338b763115f0269b209e777608e4cd31785 via Pull Request #1149, which introduces validateImageUrl and validateProxyUrl helpers from @/lib/security/url-validation. Additional discussion is available in GitHub Issue #960 and vulnerability tracking data in VulDB entry #323057.

Workarounds

Place the sim application behind a reverse proxy or WAF that rejects requests where filePath contains private IPs, loopback addresses, or non-HTTPS schemes.
Enforce strict outbound network policies using host-based firewall rules or cloud security groups to prevent the server from reaching internal management interfaces.
Require the metadata service to use IMDSv2 (on AWS) or the equivalent hardened mode on other cloud providers, reducing the impact of a successful SSRF.

bash

# Example egress restriction using iptables to block access to cloud metadata service
iptables -A OUTPUT -m owner --uid-owner sim -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner sim -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner sim -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner sim -d 192.168.0.0/16 -j REJECT