CVE-2025-13789 Overview
CVE-2025-13789 is a server-side request forgery (SSRF) vulnerability in ZenTao, an open-source project management platform. The flaw affects versions up to and including 21.7.6-8564 and resides in the makeRequest function of the module/ai/model.php file. Attackers can manipulate the Base argument to force the server to issue arbitrary outbound HTTP requests. The vulnerability is exploitable over the network and requires only low-privilege authentication. The exploit details have been publicly disclosed, and upgrading to version 21.7.6 mitigates the issue.
Critical Impact
Authenticated remote attackers can coerce the ZenTao server into issuing HTTP requests to attacker-chosen destinations, enabling internal network reconnaissance and potential access to metadata services or internal APIs.
Affected Products
- ZenTao versions up to 21.7.6-8564
- Affected component: module/ai/model.php (makeRequest function)
- Fixed release: ZenTao 21.7.6
Discovery Timeline
- 2025-11-30 - CVE-2025-13789 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13789
Vulnerability Analysis
The vulnerability is classified as Server-Side Request Forgery under CWE-918. It resides in the makeRequest function within the ZenTao AI module at module/ai/model.php. This function accepts a user-controlled Base argument that determines the destination URL for an outbound HTTP request. Because the input is not restricted to an allowlist of trusted endpoints, an authenticated attacker can substitute internal hostnames, loopback interfaces, or cloud metadata endpoints.
An attacker with a low-privilege ZenTao account can invoke the AI model configuration path and supply a crafted Base URL. The application then issues the request from the ZenTao server's network context, returning content and behavior that can be probed remotely. The EPSS score is 0.294% at percentile 21.568, indicating limited near-term exploitation likelihood despite public disclosure.
Root Cause
The root cause is missing validation of the Base argument passed to makeRequest. The AI model integration was designed to allow administrators to specify custom API endpoints for large language model providers. However, the code path performs no scheme filtering, no host allowlisting, and no defense against internal address ranges such as 127.0.0.0/8, 169.254.169.254, or RFC1918 networks.
Attack Vector
The attack requires network access to the ZenTao web interface and a valid low-privilege session. The attacker sends an HTTP request to the AI model endpoint with a manipulated Base parameter pointing to an internal target. ZenTao's backend then issues the outbound request and processes the response within the AI workflow. This can be used to enumerate internal services, retrieve cloud instance metadata, or reach administrative interfaces that are not exposed externally.
See the public issue report and the VulDB Threat Intelligence entry for additional technical detail.
Detection Methods for CVE-2025-13789
Indicators of Compromise
- Outbound HTTP requests from the ZenTao application server to internal IP ranges, loopback addresses, or cloud metadata endpoints such as 169.254.169.254.
- Web server access logs showing POST or GET requests to the AI model configuration route with unusual Base parameter values.
- Unexpected DNS queries originating from the ZenTao host for attacker-controlled or internal-only hostnames.
Detection Strategies
- Inspect ZenTao web logs for requests targeting module/ai/model.php combined with anomalous Base argument content, especially values containing localhost, private IP ranges, or non-HTTPS schemes.
- Correlate application-layer request logs with egress firewall telemetry to identify server-initiated requests that do not match expected AI provider destinations.
- Baseline outbound connections from the ZenTao server and alert on deviations to new hosts or internal subnets.
Monitoring Recommendations
- Enable verbose logging on the ZenTao AI module and forward logs to a centralized analytics platform for retention and query.
- Monitor cloud metadata service access from any application server hosting ZenTao, as this is a common SSRF exfiltration target.
- Track authentication events for low-privilege accounts that access AI configuration endpoints outside of administrative workflows.
How to Mitigate CVE-2025-13789
Immediate Actions Required
- Upgrade ZenTao to version 21.7.6 or later, which addresses the SSRF condition in makeRequest.
- Restrict access to the ZenTao web interface with network segmentation and require multi-factor authentication for all accounts.
- Audit user accounts and revoke unnecessary privileges to reduce the pool of accounts that can reach the affected endpoint.
Patch Information
The vendor released a fix in ZenTao 21.7.6. Refer to the ZenTao Extension Overview for release notes and upgrade instructions. Verify the running version after upgrade and confirm the AI module reflects the patched code path.
Workarounds
- Block the ZenTao application server from initiating outbound connections to internal networks, loopback interfaces, and cloud metadata IPs using host or egress firewall rules.
- Disable the AI model integration feature until the upgrade is applied if the functionality is not required.
- Place an egress proxy in front of the ZenTao server that enforces an allowlist of approved AI provider hostnames.
# Example egress restriction using iptables to block metadata service access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
