CVE-2025-10391 Overview
CVE-2025-10391 is a Server-Side Request Forgery (SSRF) vulnerability affecting CRMEB versions up to 5.6.1. The flaw resides in the testOutUrl function within app/services/out/OutAccountServices.php. Authenticated attackers can manipulate the push_token_url argument to force the application server to issue arbitrary outbound HTTP requests. The exploit has been disclosed publicly, and the vendor did not respond to the disclosure attempt. The weakness is classified under CWE-918.
Critical Impact
Remote authenticated attackers can coerce the CRMEB server into making attacker-controlled requests, enabling probing of internal networks, access to cloud metadata services, or interaction with otherwise unreachable internal endpoints.
Affected Products
- CRMEB versions up to and including 5.6.1
- Component: app/services/out/OutAccountServices.php
- Vulnerable function: testOutUrl
Discovery Timeline
- 2025-09-14 - CVE-2025-10391 published to NVD
- 2026-04-29 - Last updated in NVD database
Technical Details for CVE-2025-10391
Vulnerability Analysis
The vulnerability stems from missing validation of a user-supplied URL inside the testOutUrl method of OutAccountServices.php. The push_token_url parameter is consumed directly by a server-side HTTP client without restricting the target scheme, host, or address range. As a result, the CRMEB server can be instructed to issue HTTP requests to hosts chosen by the attacker.
SSRF [CWE-918] in this context allows an authenticated user with low privileges to pivot the server's network position. Because the server typically holds privileged network access, attackers can reach internal services that are not exposed to the public internet. The publicly disclosed exploit removes the practical barrier to weaponization, although no entry currently exists on the CISA Known Exploited Vulnerabilities catalog.
Root Cause
The root cause is improper input validation on the push_token_url argument. The function trusts the supplied URL and passes it to an outbound HTTP request routine without enforcing an allowlist of permitted destinations or blocking loopback, link-local, and private address ranges.
Attack Vector
Exploitation occurs remotely over the network and requires low-privilege authentication. The attacker submits a crafted value for push_token_url through the affected endpoint backed by testOutUrl. The server then resolves and fetches the attacker-specified URL. Targets of interest include 127.0.0.1 services, internal management interfaces, and cloud metadata endpoints such as 169.254.169.254.
No verified proof-of-concept code is reproduced here. Refer to the GitHub Exploit Analysis and VulDB entry #323826 for technical details.
Detection Methods for CVE-2025-10391
Indicators of Compromise
- Outbound HTTP requests from the CRMEB application server to internal RFC1918 addresses, 127.0.0.0/8, or 169.254.169.254.
- Web server access logs containing requests that invoke testOutUrl with non-standard push_token_url values.
- Unexpected DNS resolutions originating from the CRMEB host targeting attacker-controlled domains.
Detection Strategies
- Inspect application logs for calls to the OutAccountServices::testOutUrl code path and capture the submitted push_token_url value.
- Deploy egress filtering and alert on requests from the CRMEB server destined for private, loopback, or metadata IP ranges.
- Correlate authenticated session activity with anomalous outbound connection patterns from the application tier.
Monitoring Recommendations
- Forward web application and PHP error logs to a centralized logging platform and create rules for the testOutUrl endpoint.
- Monitor cloud provider audit logs for unexpected reads of instance metadata or internal service endpoints.
- Track outbound network flow records from CRMEB hosts and baseline normal destinations.
How to Mitigate CVE-2025-10391
Immediate Actions Required
- Restrict access to administrative and authenticated endpoints that invoke testOutUrl to trusted users and IP ranges.
- Implement egress filtering on the CRMEB server to block requests to internal, loopback, and metadata addresses.
- Audit existing logs for prior exploitation indicators involving the push_token_url parameter.
Patch Information
No vendor patch is referenced in the published advisory. The vendor was contacted prior to disclosure but did not respond. Operators should track the CRMEB project for updates beyond version 5.6.1 and apply fixes as soon as they are released.
Workarounds
- Place a reverse proxy or web application firewall in front of CRMEB and block requests containing internal IP literals or non-HTTP schemes in the push_token_url parameter.
- Enforce an allowlist of permitted destination hosts at the network layer for traffic leaving the CRMEB application server.
- Disable or remove the testOutUrl route if it is not required for production operation.
# Example egress restriction using iptables to block SSRF targets
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
