CVE-2025-14518: PowerJob SSRF Vulnerability

CVE-2025-14518 Overview

A Server-Side Request Forgery (SSRF) vulnerability has been identified in PowerJob versions up to and including 5.1.2. This vulnerability affects the checkConnectivity function within the file src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java of the Network Request Handler component. Attackers can exploit this flaw by manipulating the targetIp and targetPort arguments, enabling unauthorized server-side requests to internal or external resources. The vulnerability is remotely exploitable, and exploit details have been publicly disclosed.

Critical Impact

Attackers can leverage this SSRF vulnerability to probe internal network infrastructure, access sensitive internal services, or pivot attacks to other systems within the network perimeter.

Affected Products

• PowerJob versions up to 5.1.2
• src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java - Network Request Handler component

Discovery Timeline

• 2025-12-11 - CVE-2025-14518 published to NVD
• 2026-02-24 - Last updated in NVD database

Technical Details for CVE-2025-14518

Vulnerability Analysis

This vulnerability is classified as Server-Side Request Forgery (SSRF), categorized under CWE-918. The flaw exists in the checkConnectivity function of PowerJob's PingPongUtils.java utility class, which is responsible for network connectivity testing. The function accepts user-controlled input for the targetIp and targetPort parameters without adequate validation or sanitization.

When exploited, attackers can craft malicious requests that cause the PowerJob server to initiate network connections to arbitrary destinations. This can be leveraged to bypass firewall restrictions, scan internal network ports, access cloud metadata services (such as AWS EC2 metadata endpoints), or interact with internal services that should not be externally accessible.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation within the checkConnectivity function. The targetIp and targetPort parameters are directly used to establish network connections without proper sanitization or allowlist validation. This allows attackers to specify arbitrary IP addresses, including internal RFC 1918 addresses, localhost, cloud metadata endpoints, or other sensitive network destinations.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the PowerJob application. Exploitation involves submitting crafted requests containing malicious targetIp and targetPort values through the Network Request Handler. The server processes these inputs and initiates connections to the specified targets on behalf of the attacker.

Successful exploitation may enable attackers to:

• Access internal services behind firewalls
• Retrieve cloud instance metadata and credentials
• Perform port scanning of internal network infrastructure
• Interact with administrative interfaces on internal systems

For detailed technical information and proof-of-concept details, refer to GitHub Issue #1144 and the VulDB Entry #335856.

Detection Methods for CVE-2025-14518

Indicators of Compromise

• Unusual outbound connection attempts from PowerJob server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints (e.g., 169.254.169.254) originating from the PowerJob application
• Anomalous network activity from the PowerJob service to previously uncontacted internal hosts
• Log entries showing connectivity checks to unexpected or suspicious target addresses

Detection Strategies

• Implement network monitoring to detect outbound connections from PowerJob servers to internal network ranges that deviate from normal operational patterns
• Deploy web application firewall (WAF) rules to inspect and block requests containing internal IP addresses or metadata endpoint addresses in parameter values
• Monitor application logs for the checkConnectivity function calls with suspicious targetIp or targetPort parameters
• Utilize SentinelOne's behavioral AI to detect anomalous network request patterns indicative of SSRF exploitation

Monitoring Recommendations

• Enable detailed logging for all network connectivity operations within PowerJob
• Configure alerts for connection attempts to RFC 1918 private address spaces from the PowerJob application
• Implement network segmentation monitoring to track cross-segment traffic initiated by PowerJob servers
• Review access logs regularly for patterns of systematic internal port scanning or metadata endpoint access attempts

How to Mitigate CVE-2025-14518

Immediate Actions Required

• Upgrade PowerJob to the latest version if a patched release is available
• Implement network-level controls to restrict PowerJob server outbound connections to only necessary external endpoints
• Apply strict input validation for targetIp and targetPort parameters using allowlists of permitted destinations
• Temporarily disable or restrict access to the connectivity check functionality if not critical to operations

Patch Information

At the time of publication, users should monitor the PowerJob GitHub Repository for official security patches addressing this SSRF vulnerability. Review GitHub Issue #1144 for updates from the development team regarding remediation timelines and patch availability.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block requests containing private IP addresses or cloud metadata endpoint addresses
• Apply network-level egress filtering to prevent PowerJob servers from initiating connections to internal network ranges
• Use a reverse proxy to intercept and validate connectivity check requests before they reach the PowerJob application
• Restrict authenticated access to PowerJob to only trusted users and service accounts

# Example iptables rules to restrict PowerJob outbound connections
# Block connections to internal networks from PowerJob
iptables -A OUTPUT -m owner --uid-owner powerjob -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner powerjob -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner powerjob -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner powerjob -d 169.254.169.254 -j DROP