CVE-2025-14518: Powerjob SSRF Vulnerability Explained

CVE-2025-14518 Overview

CVE-2025-14518 is a Server-Side Request Forgery (SSRF) vulnerability in PowerJob versions up to 5.1.2. The flaw resides in the checkConnectivity function within src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java, part of the Network Request Handler component. Attackers can manipulate the targetIp and targetPort arguments to coerce the server into issuing arbitrary network requests. The vulnerability is remotely exploitable and a public exploit description exists. PowerJob is an open-source distributed task scheduling framework, making exposure of the management interface a meaningful concern for internal networks.

Critical Impact

Authenticated remote attackers can leverage PowerJob as a proxy to probe internal network services, bypassing perimeter controls and enabling reconnaissance against systems not directly reachable from the internet.

Affected Products

• PowerJob versions up to and including 5.1.2
• Component: tech.powerjob.common.utils.net.PingPongUtils (Network Request Handler)
• Function: checkConnectivity

Discovery Timeline

• 2025-12-11 - CVE-2025-14518 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-14518

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. PowerJob exposes a connectivity check feature that accepts a target host and port from a client request and performs an outbound TCP or HTTP probe to that destination. Because the checkConnectivity function does not validate or restrict the supplied targetIp and targetPort parameters, an attacker can direct the PowerJob server to connect to arbitrary internal hosts.

SSRF in a scheduling framework is particularly useful for attackers performing internal reconnaissance. PowerJob server instances frequently run inside trusted network segments alongside databases, message brokers, and cloud metadata endpoints. The attacker requires low privileges, and no user interaction is needed. While the direct confidentiality and integrity impact is limited, the vulnerability becomes a pivot primitive in chained attacks.

Root Cause

The root cause is missing input validation on network destination parameters. The checkConnectivity routine treats user-supplied IP addresses and ports as trusted, with no allowlist of permitted targets, no blocklist for loopback or RFC1918 ranges, and no filter for cloud metadata addresses such as 169.254.169.254.

Attack Vector

An authenticated remote attacker sends a crafted request to the PowerJob endpoint that invokes checkConnectivity, specifying an internal address and port in the targetIp and targetPort fields. The PowerJob server initiates the connection from its own network context. The attacker observes response timing, error messages, or returned data to map internal services. Refer to the GitHub Issue #1144 and VulDB entry #335856 for technical details on the request structure.

Detection Methods for CVE-2025-14518

Indicators of Compromise

• Outbound connections from PowerJob server processes to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that do not match expected worker node addresses.
• Connection attempts from the PowerJob server to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
• Repeated checkConnectivity invocations in PowerJob application logs targeting varied IP and port combinations, indicating port-scan behavior.

Detection Strategies

• Inspect PowerJob server logs for high-frequency or sequential calls to the connectivity check endpoint, particularly with non-worker target addresses.
• Correlate web application firewall (WAF) logs with PowerJob outbound network telemetry to identify request-to-connection pivots.
• Deploy egress filtering alerts that fire when the PowerJob host attempts connections outside its documented worker subnet.

Monitoring Recommendations

• Capture and retain PowerJob HTTP access logs with full request body parameters for the connectivity check API.
• Enable network flow logging on the PowerJob server subnet to baseline normal worker communication patterns.
• Alert on any PowerJob-originated traffic to IMDS addresses or to internal management interfaces such as Kubernetes API, Redis, or database ports.

How to Mitigate CVE-2025-14518

Immediate Actions Required

• Restrict access to the PowerJob management console and APIs to trusted administrators only, using network ACLs or a reverse proxy with authentication enforcement.
• Place the PowerJob server in a segmented network that cannot reach cloud metadata services, sensitive internal applications, or production databases not required for job execution.
• Audit existing PowerJob deployments for unexpected checkConnectivity calls in logs over the last 90 days.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD record. Monitor the PowerJob GitHub repository and GitHub Issue #1144 for fix releases beyond version 5.1.2. Upgrade to a patched release as soon as one becomes available.

Workarounds

• Apply host-based egress firewall rules on the PowerJob server that permit outbound traffic only to known worker IP addresses and required infrastructure.
• Block outbound requests from the PowerJob process to link-local and metadata addresses (169.254.0.0/16).
• Disable or remove the connectivity check feature if it is not operationally required, by restricting the endpoint at a reverse proxy layer.
• Enforce strong authentication and role-based access control on the PowerJob console to reduce the population of users who can invoke the vulnerable function.

# Example iptables egress restriction for PowerJob host
# Allow outbound to known worker subnet only
iptables -A OUTPUT -p tcp -d 10.20.30.0/24 -j ACCEPT
# Block link-local / cloud metadata
iptables -A OUTPUT -p tcp -d 169.254.0.0/16 -j REJECT
# Block RFC1918 ranges not used by workers
iptables -A OUTPUT -p tcp -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -p tcp -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -p tcp -d 192.168.0.0/16 -j REJECT