CVE-2025-10395 Overview
CVE-2025-10395 is a Server-Side Request Forgery (SSRF) vulnerability in Magicblack MacCMS version 2025.1000.4050. The flaw resides in the col_url function of the Scheduled Task Handler component. Attackers can manipulate the cjurl argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is exploitable remotely over the network, but it requires high privileges on the application. The weakness is tracked under CWE-918 (Server-Side Request Forgery).
Critical Impact
Authenticated attackers can abuse the MacCMS scheduled task feature to reach internal services, perform host reconnaissance, or interact with cloud metadata endpoints from the server context.
Affected Products
- Magicblack MacCMS 2025.1000.4050
- Component: Scheduled Task Handler (col_url function)
- Affected parameter: cjurl
Discovery Timeline
- 2025-09-14 - CVE-2025-10395 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-10395
Vulnerability Analysis
The vulnerability exists in the col_url function inside the MacCMS Scheduled Task Handler. The handler accepts a user-controlled URL through the cjurl argument and dispatches a server-initiated request to that location without sufficient validation. Because the request originates from the MacCMS host, attackers can target resources that are otherwise unreachable from the public internet. Typical SSRF impact in this context includes probing internal IP ranges, reaching administrative interfaces bound to localhost, and querying cloud instance metadata services. The exploit prediction score (EPSS) at the time of analysis is 0.318% (percentile 23.3), indicating limited observed exploitation activity.
Root Cause
The root cause is missing or insufficient validation of the cjurl argument before the scheduled task handler initiates an outbound HTTP request. The application trusts the supplied URL and does not enforce an allowlist of destinations, restrict private IP ranges, or block redirection to internal endpoints. This pattern matches the CWE-918 definition of Server-Side Request Forgery.
Attack Vector
Exploitation requires network access to the MacCMS web interface and an authenticated session with administrative privileges sufficient to reach the scheduled task functionality. An attacker submits a crafted value for the cjurl parameter that points to an internal address or sensitive endpoint. The MacCMS server then performs the request on the attacker's behalf and may expose the response or side effects to the caller. Public technical details for this issue are available in the GitHub Security Documentation and the VulDB entry #323830.
No verified proof-of-concept code is published in the referenced advisory data, so this analysis describes the mechanism in prose only.
Detection Methods for CVE-2025-10395
Indicators of Compromise
- Outbound HTTP requests from the MacCMS host to internal RFC1918 addresses, loopback interfaces, or cloud metadata services such as 169.254.169.254.
- Web server access logs showing requests to scheduled task endpoints with attacker-controlled cjurl values.
- Unexpected entries in the MacCMS scheduled task configuration referencing external or internal URLs.
Detection Strategies
- Inspect MacCMS application and web server logs for invocations of the col_url function with cjurl parameters pointing to non-public destinations.
- Correlate authenticated admin sessions with outbound network connections originating from the PHP worker process serving MacCMS.
- Apply CWE-918 detection signatures to web application firewalls that flag SSRF-style URL parameters.
Monitoring Recommendations
- Monitor egress traffic from the MacCMS server and alert on connections to internal subnets or metadata IPs.
- Track creation and modification events for scheduled tasks within MacCMS administrative logs.
- Forward web, application, and network telemetry to a centralized data lake to support cross-source correlation of SSRF attempts.
How to Mitigate CVE-2025-10395
Immediate Actions Required
- Restrict access to the MacCMS administrative interface to trusted networks and enforce strong authentication on all privileged accounts.
- Audit existing scheduled tasks and remove any entries with suspicious or internal cjurl values.
- Place the MacCMS host behind an egress proxy that blocks requests to private IP ranges and cloud metadata endpoints.
Patch Information
At the time of this writing, no vendor advisory or patched release for Magicblack MacCMS 2025.1000.4050 is referenced in the available CVE data. Operators should monitor the VulDB entry #323830 and the upstream MacCMS project for updates and apply fixes as soon as they are published.
Workarounds
- Disable or restrict the Scheduled Task Handler functionality until a vendor patch is available.
- Deploy a web application firewall rule that validates the cjurl parameter and rejects values containing internal IP addresses, loopback hosts, or non-HTTP schemes.
- Run the MacCMS process under a network policy that denies outbound traffic to internal subnets and the 169.254.169.254 metadata service.
# Example egress restriction using iptables to block metadata and RFC1918 destinations
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
