CVE-2025-13147 Overview
CVE-2025-13147 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting Progress MOVEit Transfer. The flaw allows an unauthenticated attacker to induce the MOVEit Transfer server to issue HTTP requests to arbitrary destinations selected by the attacker. The issue affects MOVEit Transfer versions before 2024.1.8 and versions from 2025.0.0 before 2025.0.4. Progress addressed the vulnerability in the 2024.1.8, 2025.0.4, and 2025.1 releases as documented in the vendor release notes.
Critical Impact
An unauthenticated remote attacker can coerce MOVEit Transfer to make outbound requests to internal or external systems, enabling reconnaissance of internal network resources and limited information disclosure.
Affected Products
- Progress MOVEit Transfer versions before 2024.1.8
- Progress MOVEit Transfer versions from 2025.0.0 before 2025.0.4
- Progress MOVEit Transfer 2025.1 (fixed release)
Discovery Timeline
- 2025-11-19 - CVE-2025-13147 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13147
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery weakness categorized under [CWE-918]. MOVEit Transfer accepts a user-supplied URL or URL component and dispatches a server-side HTTP request without adequately validating the destination. An attacker can supply a URL that references internal-only endpoints, cloud metadata services, or arbitrary third-party hosts. The MOVEit Transfer service then performs the request from its own network position, which typically has broader access than an external attacker. The impact is limited to confidentiality of returned data, with no direct integrity or availability impact per the CVSS vector.
Root Cause
The root cause is insufficient validation of destination URLs handled by MOVEit Transfer request-issuing functionality. The application does not enforce a strict allow-list of hosts, schemes, or IP ranges before performing outbound network calls. As a result, unauthenticated inputs can traverse network boundaries that the underlying HTTP client can reach.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to a vulnerable MOVEit Transfer endpoint containing a URL parameter under their control. MOVEit Transfer processes the parameter and issues a request to the attacker-specified target. Attackers commonly abuse SSRF against MOVEit Transfer to probe internal services, enumerate reachable hosts, query cloud instance metadata endpoints, or bypass network segmentation controls that assume the MOVEit host is trusted.
No public proof-of-concept exploit or CISA KEV listing exists for this issue as of publication. Refer to the Progress MoveIt Release Notes 2024 and Progress MoveIt Release Notes 2025 for vendor-published fix details.
Detection Methods for CVE-2025-13147
Indicators of Compromise
- Outbound HTTP or HTTPS connections originating from the MOVEit Transfer host to internal IP ranges, link-local addresses such as 169.254.169.254, or unexpected external hosts.
- MOVEit Transfer application or IIS logs containing URL parameters referencing IP literals, non-standard ports, or file://, gopher://, or http:// schemes pointing to private ranges.
- Anomalous DNS queries from the MOVEit Transfer server resolving attacker-controlled or internal-only hostnames.
Detection Strategies
- Inspect MOVEit Transfer web server logs for unauthenticated requests containing URL-like query parameters and correlate them with subsequent outbound connections from the host.
- Baseline the normal outbound destinations of the MOVEit Transfer service account and alert on deviations, particularly connections to RFC1918 ranges or cloud metadata endpoints.
- Deploy web application firewall rules that reject requests containing URL parameters resolving to internal address space before they reach MOVEit Transfer.
Monitoring Recommendations
- Enable verbose HTTP access and audit logging on the MOVEit Transfer server and forward logs to a centralized analytics platform for retention and correlation.
- Monitor egress traffic from MOVEit Transfer at the firewall or proxy layer and restrict destinations to a documented allow-list.
- Track process-level network activity on the MOVEit Transfer host to identify unexpected connection targets initiated by the web service process.
How to Mitigate CVE-2025-13147
Immediate Actions Required
- Upgrade MOVEit Transfer to version 2024.1.8, 2025.0.4, or 2025.1 as published by Progress.
- Restrict outbound network access from MOVEit Transfer hosts to only the destinations required for business operations.
- Block MOVEit Transfer egress to cloud instance metadata endpoints such as 169.254.169.254 and to internal management networks.
Patch Information
Progress released fixes in MOVEit Transfer 2024.1.8, 2025.0.4, and 2025.1. Administrators should consult the Progress MoveIt Release Notes 2024, Progress MoveIt Release Notes 2025, and Progress MoveIt Release Notes 2025.1 to identify the appropriate upgrade path.
Workarounds
- Place MOVEit Transfer behind a reverse proxy or web application firewall that filters URL parameters referencing internal address ranges or unexpected schemes.
- Enforce strict egress firewall rules limiting MOVEit Transfer outbound connectivity to a defined allow-list of hostnames and ports.
- Segment MOVEit Transfer from sensitive internal services and cloud metadata endpoints using network access control lists.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
