CVE-2025-10211 Overview
CVE-2025-10211 is a server-side request forgery (SSRF) vulnerability in yanyutao0402 ChanCMS version 3.3.0. The flaw resides in the CollectController function handling the /cms/collect/getArticle endpoint. An authenticated attacker can manipulate the taskUrl argument to force the server to issue arbitrary outbound HTTP requests. The issue is classified under CWE-918: Server-Side Request Forgery. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts. The vulnerability is remotely exploitable over the network with low attack complexity.
Critical Impact
Attackers with low-privileged access can coerce the ChanCMS server into sending crafted HTTP requests to internal or external hosts, enabling internal network reconnaissance and access to services not otherwise exposed.
Affected Products
- yanyutao0402 ChanCMS 3.3.0
- CPE: cpe:2.3:a:chancms:chancms:3.3.0:*:*:*:*:*:*:*
- Affected component: CollectController handling /cms/collect/getArticle
Discovery Timeline
- 2025-09-10 - CVE-2025-10211 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10211
Vulnerability Analysis
ChanCMS 3.3.0 exposes a content collection feature that fetches remote articles for import. The CollectController reads the taskUrl parameter from the /cms/collect/getArticle request and passes it to a server-side HTTP client without validating the destination. An attacker can substitute any URL, including internal IP ranges, loopback addresses, cloud metadata endpoints, or non-HTTP schemes supported by the underlying client. The server executes the request under its own network position, returning response data or side effects to the attacker. The CWE-918 classification reflects a canonical SSRF weakness caused by missing allow-list validation and missing egress controls. Exploitation requires only low-privileged authentication on the CMS.
Root Cause
The root cause is insufficient validation of user-supplied URLs in the taskUrl parameter. The CollectController treats the value as trusted input and dispatches an HTTP request without restricting hostnames, IP ranges, or protocols. There is no allow-list, DNS pinning, or block-list for internal network space such as 127.0.0.0/8, 10.0.0.0/8, 169.254.169.254, or 172.16.0.0/12.
Attack Vector
A remote attacker authenticated with a low-privileged CMS account sends a crafted request to /cms/collect/getArticle with the taskUrl argument pointing to a target of interest. Typical abuse scenarios include probing internal services, reading cloud instance metadata, pivoting to admin panels bound to localhost, and reflecting HTTP responses through the CMS. The request originates from the ChanCMS server, bypassing perimeter controls that trust internal traffic.
See the GitHub PoC for CVE-2025-10211 for full request details and the VulDB entry #323484 for additional context.
Detection Methods for CVE-2025-10211
Indicators of Compromise
- HTTP POST or GET requests to /cms/collect/getArticle containing taskUrl values referencing internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Outbound connections initiated by the ChanCMS application process to unexpected internal hosts or non-standard ports.
- Application logs showing repeated CollectController.getArticle invocations from a single authenticated session.
Detection Strategies
- Inspect web server and application logs for taskUrl parameters whose hostnames resolve to RFC1918, link-local, or loopback address ranges.
- Correlate authenticated CMS sessions with subsequent egress traffic from the ChanCMS host to detect anomalous fetch patterns.
- Deploy a web application firewall rule that blocks or alerts on requests to /cms/collect/getArticle when taskUrl fails a URL allow-list check.
Monitoring Recommendations
- Enable DNS query logging on the ChanCMS host and alert on lookups for internal, metadata, or cloud provider service endpoints.
- Baseline normal outbound destinations from the CMS server and alert on deviations, including new ports or protocols.
- Forward CMS application logs and network telemetry into a central data lake for correlation across authentication, HTTP, and egress events.
How to Mitigate CVE-2025-10211
Immediate Actions Required
- Restrict access to /cms/collect/getArticle at the reverse proxy or WAF layer until a patched build is available.
- Rotate credentials for low-privileged CMS accounts and audit account provisioning to reduce the pool of accounts able to reach the vulnerable endpoint.
- Place the ChanCMS server behind egress filtering that blocks outbound connections to RFC1918 ranges, 127.0.0.0/8, and 169.254.169.254.
- Review recent application logs for exploitation attempts referencing internal addresses in taskUrl.
Patch Information
No vendor patch is available at the time of publication. According to the NVD entry, the vendor was contacted before public disclosure but did not respond. Track the VulDB record #323484 and the GitHub advisory for updates. Consider migrating away from ChanCMS 3.3.0 if the vendor remains unresponsive.
Workarounds
- Disable the content collection feature or remove the /cms/collect/getArticle route through reverse proxy rules if the feature is not required.
- Enforce an explicit allow-list of remote hostnames permitted for article collection at the network egress layer.
- Deploy an outbound proxy that requires the CMS to route external HTTP requests through a broker capable of URL allow-listing and metadata endpoint blocking.
- Isolate the ChanCMS host on a segmented network with no route to internal management interfaces or cloud metadata services.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
