CVE-2025-15104: Nu Html Checker SSRF Vulnerability

CVE-2025-15104 Overview

CVE-2025-15104 is a Server-Side Request Forgery (SSRF) vulnerability in Nu Html Checker (validator.nu) that allows remote attackers to bypass hostname-based protections and make the server perform arbitrary HTTP/HTTPS requests to internal resources, including localhost services. While the validator implements protections to block direct access to localhost and 127.0.0.1, these controls can be circumvented using DNS rebinding techniques or domains that resolve to loopback addresses.

Critical Impact

Attackers can exploit this SSRF vulnerability to access internal network resources, potentially exposing sensitive services, internal APIs, and cloud metadata endpoints that should not be accessible from the public internet.

Affected Products

• Nu Html Checker (vnu) - commit 23f090a11bab8d0d4e698f1ffc197a4fe226a9cd and potentially earlier versions
• validator.nu web service deployments
• Self-hosted Nu Html Checker instances

Discovery Timeline

• January 16, 2026 - CVE-2025-15104 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2025-15104

Vulnerability Analysis

This vulnerability falls under CWE-918 (Server-Side Request Forgery), where the application accepts a URL from user input and fetches its content without adequately validating whether the destination is safe. The Nu Html Checker is designed to validate HTML documents by fetching URLs provided by users. To prevent abuse, it implements hostname-based blocking for common localhost addresses.

However, the protection mechanism is insufficient because it only checks for literal string matches against known localhost identifiers. Attackers can bypass this restriction through multiple techniques including DNS rebinding, where a domain initially resolves to a benign IP address during validation but resolves to a loopback address (127.0.0.1) when the actual request is made.

Root Cause

The root cause is incomplete input validation when processing user-supplied URLs. The hostname validation logic fails to account for:

1. DNS rebinding attacks where domain resolution changes between validation and request time
2. Alternative representations of loopback addresses (e.g., 127.0.0.2, 0.0.0.0, IPv6 ::1)
3. Domains that legitimately resolve to loopback addresses
4. Time-of-check to time-of-use (TOCTOU) race conditions in DNS resolution

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious URL using a domain they control configured for DNS rebinding. When submitted to the Nu Html Checker:

1. The attacker configures a DNS server to return different IP addresses for the same domain based on timing
2. Initial DNS resolution returns a safe external IP, passing the hostname validation
3. Subsequent DNS resolution during the actual HTTP request returns 127.0.0.1
4. The validator fetches content from the internal localhost service

This technique can be used to probe internal services, access cloud metadata endpoints (e.g., AWS 169.254.169.254), or exfiltrate data from services running on the same host.

Detection Methods for CVE-2025-15104

Indicators of Compromise

• Unusual outbound requests from the validator service to internal IP ranges
• DNS queries for known DNS rebinding domains or suspicious short-TTL domains
• Access logs showing requests to cloud metadata endpoints or internal service ports
• Network traffic from the validator to localhost or private IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)

Detection Strategies

• Monitor network egress from validator instances for connections to RFC 1918 private addresses
• Implement DNS logging and alert on domains with suspiciously low TTL values
• Deploy application-layer firewalls that inspect and block requests to internal resources
• Use SentinelOne Singularity to detect anomalous network behavior from web application processes

Monitoring Recommendations

• Enable verbose logging for the Nu Html Checker service to capture all URL fetch attempts
• Implement network segmentation to limit the impact of successful SSRF exploitation
• Deploy intrusion detection rules for known DNS rebinding patterns
• Monitor for unusual process network activity using endpoint detection and response (EDR) solutions

How to Mitigate CVE-2025-15104

Immediate Actions Required

• Restrict network access from the validator service to only necessary external endpoints
• Deploy a web application firewall (WAF) with SSRF protection capabilities
• Implement IP-based validation at the network layer rather than relying solely on hostname checks
• Consider disabling the URL validation feature if not strictly required

Patch Information

As of the last NVD update on January 16, 2026, no official patch has been documented. Monitor the GitHub Validator Repository for security updates and patches. Review the Fluid Attacks Advisory for additional remediation guidance.

Workarounds

• Configure firewall rules to block outbound connections from the validator to internal IP ranges and localhost
• Use a DNS resolver that implements rebinding protection by blocking responses containing private IP addresses
• Deploy the validator in an isolated network segment with no access to sensitive internal resources
• Implement request-time IP validation by resolving the hostname immediately before the request and validating the resolved IP
• Consider running the validator behind a proxy that enforces destination restrictions

# Configuration example - iptables rules to restrict outbound connections
# Block the validator user from connecting to localhost
iptables -A OUTPUT -m owner --uid-owner validator -d 127.0.0.0/8 -j DROP

# Block connections to private IP ranges
iptables -A OUTPUT -m owner --uid-owner validator -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner validator -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner validator -d 192.168.0.0/16 -j DROP

# Block link-local and cloud metadata endpoints
iptables -A OUTPUT -m owner --uid-owner validator -d 169.254.0.0/16 -j DROP