CVE-2025-14004: Xunruicms SSRF Vulnerability

CVE-2025-14004 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been discovered in dayrui XunRuiCMS up to version 4.7.1. The vulnerability affects an unknown function in the file /admind45f74adbd95.php?c=email&m=add within the Email Setting Handler component. By manipulating input parameters, an attacker can force the server to make arbitrary requests to internal or external resources, potentially exposing sensitive internal services or enabling further attacks against the infrastructure.

Critical Impact

This SSRF vulnerability allows remote attackers to manipulate the CMS server into making requests to arbitrary internal and external endpoints, potentially exposing internal services, bypassing firewalls, and accessing sensitive resources that should not be publicly accessible.

Affected Products

• XunRuiCMS versions up to and including 4.7.1
• Email Setting Handler component (/admind45f74adbd95.php?c=email&m=add)

Discovery Timeline

• 2025-12-04 - CVE-2025-14004 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-14004

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The SSRF flaw exists within the Email Setting Handler component of XunRuiCMS. The vulnerability is network-accessible and requires high privileges to exploit, but once leveraged, it can compromise the confidentiality, integrity, and availability of the affected system.

The exploit has been publicly disclosed and may be actively used for attacks. The vendor was contacted about this vulnerability but did not respond, leaving users without an official patch. A proof-of-concept demonstrating the vulnerability has been published on GitHub.

Root Cause

The root cause of this vulnerability lies in insufficient input validation within the Email Setting Handler functionality. When processing email configuration requests through the /admind45f74adbd95.php?c=email&m=add endpoint, the application fails to properly validate and sanitize user-supplied URLs or hostnames. This allows authenticated administrators to specify arbitrary internal or external URLs that the server will then attempt to connect to, enabling SSRF attacks.

Attack Vector

The attack vector for CVE-2025-14004 is network-based, requiring the attacker to have administrative privileges on the XunRuiCMS installation. The attack can be executed remotely without user interaction. An attacker with admin access can manipulate the email configuration settings to force the server to make requests to:

• Internal network services not normally accessible from the internet
• Cloud metadata endpoints (e.g., 169.254.169.254) to retrieve sensitive credentials
• Other internal applications for port scanning or service enumeration
• External attacker-controlled servers to exfiltrate data

The vulnerability is exploited through the email testing or configuration functionality, where the attacker can specify malicious SMTP server addresses or related parameters that trigger outbound requests from the vulnerable server.

Detection Methods for CVE-2025-14004

Indicators of Compromise

• Unusual outbound requests from the web server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints such as 169.254.169.254
• Unexpected connections to ports commonly used by internal services (Redis, Memcached, databases)
• Administrative access to /admind45f74adbd95.php with unusual email component parameters

Detection Strategies

• Monitor web application logs for requests to the Email Setting Handler endpoint with suspicious parameters
• Implement network-level monitoring to detect SSRF-indicative traffic patterns from web servers
• Deploy Web Application Firewall (WAF) rules to block requests containing internal IP addresses or metadata endpoints
• Audit administrative access logs for unusual email configuration changes

Monitoring Recommendations

• Enable detailed logging for all administrative actions within XunRuiCMS
• Configure network monitoring to alert on outbound connections from the web server to internal subnets
• Implement egress filtering to restrict outbound connections from web servers to only necessary external services
• Review and monitor DNS queries from the web server for suspicious internal hostnames

How to Mitigate CVE-2025-14004

Immediate Actions Required

• Restrict administrative access to XunRuiCMS to trusted IP addresses only
• Implement network segmentation to limit the impact of potential SSRF exploitation
• Consider disabling or restricting access to the Email Setting Handler functionality until a patch is available
• Review administrative user accounts and remove unnecessary privileged access

Patch Information

As of the last update on 2026-02-24, the vendor (XunRuiCMS) has not released an official patch for this vulnerability. The vendor was contacted about this disclosure but did not respond. Users should monitor the official XunRuiCMS channels for security updates and consider implementing the workarounds below.

For additional technical details, refer to the GitHub PoC for SSRF and VulDB Case Study #334246.

Workarounds

• Implement URL allowlisting for the email configuration functionality to permit only legitimate SMTP servers
• Deploy a Web Application Firewall (WAF) with SSRF protection rules
• Use network-level controls to block outbound requests from the web server to internal IP ranges and metadata endpoints
• Consider using a reverse proxy that validates and restricts outbound requests from the application

# Example: Restrict outbound connections from web server using iptables
# Block connections to internal networks from the web server process
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP