CVE-2025-13809: Orionsec Orion-ops SSRF Vulnerability

CVE-2025-13809 Overview

CVE-2025-13809 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1. The flaw resides in the MachineInfoController.java component of the SSH Connection Handler. Attackers manipulate the host, sshPort, username, password, and authType parameters to coerce the server into initiating arbitrary outbound connections. The exploit has been publicly disclosed, and the vendor did not respond to early disclosure attempts. Remote authenticated attackers with low privileges can leverage this flaw to probe internal infrastructure.

Critical Impact

Authenticated remote attackers can abuse the SSH Connection Handler to forge server-side requests against internal hosts, enabling network reconnaissance and potential interaction with otherwise inaccessible internal services.

Affected Products

• Orionsec Orion-Ops up to commit 5925824997a3109651bbde07460958a7be249ed1
• Component: orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java
• SSH Connection Handler module

Discovery Timeline

• 2025-12-01 - CVE-2025-13809 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-13809

Vulnerability Analysis

The vulnerability resides in the SSH Connection Handler exposed by MachineInfoController.java in the orion-ops-web module. The controller accepts user-supplied connection parameters and uses them to initiate an SSH session from the application server. Because the destination host and port are not validated against an allowlist, attackers redirect connections toward arbitrary internal or external endpoints.

This behavior maps to [CWE-918] Server-Side Request Forgery. The application acts as a confused deputy, using its own network position to reach assets the attacker cannot directly contact. The flaw requires a valid authenticated session but does not require elevated privileges.

Root Cause

The root cause is missing validation of the host and sshPort parameters before establishing an outbound SSH connection. The controller trusts client input for destination addressing. No restrictions are applied against loopback addresses, private RFC1918 ranges, link-local ranges, or metadata service endpoints.

Attack Vector

An authenticated attacker submits a request to the SSH connection test endpoint with attacker-chosen values for host, sshPort, username, password, and authType. The Orion-Ops backend opens a TCP connection from the server to the attacker-specified destination. Response timing, banner content, and error messages disclose whether internal services are reachable. The vulnerability mechanism and public proof-of-concept are documented in the GitHub SSRF Report and the corresponding GitHub SSRF PoC.

Detection Methods for CVE-2025-13809

Indicators of Compromise

• Outbound SSH or TCP connections from the Orion-Ops application server to internal RFC1918 ranges that do not correspond to managed inventory.
• Repeated calls to the machine information test endpoints with varying host and sshPort values within short time windows.
• Application logs in MachineInfoController showing connection attempts to loopback addresses (127.0.0.1) or cloud metadata endpoints (169.254.169.254).

Detection Strategies

• Inspect Orion-Ops audit logs for SSH connection test requests that target hosts outside the managed asset inventory.
• Correlate authenticated session activity with outbound connection attempts to non-standard internal destinations.
• Alert on Orion-Ops processes initiating connections to cloud metadata services or administrative ports such as 6379, 9200, or 8500.

Monitoring Recommendations

• Enable verbose request logging on MachineInfoController endpoints and ship logs to a central SIEM.
• Monitor egress traffic from Orion-Ops hosts and flag destinations that fall outside the documented managed asset range.
• Review user activity for low-privilege accounts performing high volumes of connection test operations.

How to Mitigate CVE-2025-13809

Immediate Actions Required

• Restrict network egress from Orion-Ops application servers to an allowlist of managed SSH targets and required infrastructure endpoints.
• Revoke or limit low-privilege accounts that do not require access to the machine information module.
• Block outbound access from the Orion-Ops host to cloud metadata services and to loopback or link-local ranges.

Patch Information

At the time of NVD publication, the vendor had not responded to disclosure. The advisory notes that a patch should be applied once available. Track the upstream orionsec/orion-ops repository for fixes beyond commit 5925824997a3109651bbde07460958a7be249ed1. Public tracking is available via VulDB #333819 and the VulDB CTI entry.

Workarounds

• Place the Orion-Ops application behind a strict egress proxy that enforces destination allowlisting for SSH traffic.
• Apply input validation at a reverse proxy or WAF layer to reject requests where host resolves to private, loopback, or metadata addresses.
• Limit access to the Orion-Ops web interface to administrators via network segmentation and VPN until a vendor patch is released.

# Configuration example: iptables egress allowlist for Orion-Ops host
iptables -A OUTPUT -p tcp --dport 22 -d 10.10.20.0/24 -j ACCEPT
iptables -A OUTPUT -p tcp -d 169.254.169.254 -j DROP
iptables -A OUTPUT -p tcp -d 127.0.0.0/8 -j DROP
iptables -A OUTPUT -p tcp --dport 22 -j DROP