CVE-2025-2116: Founder Enjoys Media System SSRF Vulnerability

CVE-2025-2116 Overview

CVE-2025-2116 is a server-side request forgery (SSRF) vulnerability in Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0. The flaw resides in the imageProxy.do endpoint at /newsedit/newsedit/xy/imageProxy.do, part of the File Protocol Handler component. Attackers manipulate the xyImgUrl parameter to force the server to issue arbitrary outbound requests. The issue is classified under CWE-918: Server-Side Request Forgery. Exploitation requires network access and low privileges, and no user interaction is needed. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote authenticated attackers can coerce the application server to request arbitrary URLs, enabling internal network reconnaissance, access to metadata services, and interaction with internal-only endpoints.

Affected Products

Beijing Founder Electronics Founder Enjoys All-Media Acquisition and Editing System 3.0
File Protocol Handler component (/newsedit/newsedit/xy/imageProxy.do)
Deployments exposing the xyImgUrl parameter to untrusted input

Discovery Timeline

2025-03-09 - CVE-2025-2116 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2116

Vulnerability Analysis

The vulnerability resides in the imageProxy.do handler, which accepts a user-controlled URL through the xyImgUrl parameter. The application fetches the referenced resource without validating the scheme, host, or destination network. Because the handler acts as an image proxy, it returns response content and metadata to the caller, giving attackers a channel to observe results of forged requests.

An attacker with low-privilege access sends a crafted HTTP request specifying an internal address, cloud metadata endpoint, or non-HTTP scheme in xyImgUrl. The server processes the request from its own network position, bypassing perimeter controls. The vendor did not respond to disclosure, and no patch is referenced in the advisory.

Root Cause

The root cause is missing validation of the xyImgUrl parameter before the server dereferences it. The component allows arbitrary URLs and protocol handlers, which maps directly to [CWE-918]. Allow-listing of destination hosts, scheme restriction to http/https, and blocking of link-local and private ranges are absent.

Attack Vector

Exploitation occurs over the network against the /newsedit/newsedit/xy/imageProxy.do endpoint. The attacker supplies a URL in xyImgUrl pointing to internal services, such as http://127.0.0.1:8080/, http://169.254.169.254/latest/meta-data/, or file protocol handlers. The proxy component fetches the target and reflects response data, enabling internal service discovery, reading of cloud instance metadata, and interaction with unauthenticated internal APIs. No specialized tooling is required beyond an HTTP client.

See the VulDB entry #299011 and the technical write-up on Flowus for public exploitation details.

Detection Methods for CVE-2025-2116

Indicators of Compromise

HTTP requests to /newsedit/newsedit/xy/imageProxy.do containing xyImgUrl values that resolve to internal, loopback, or link-local addresses (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
Outbound connections from the application server to cloud metadata endpoints or unusual internal ports shortly after requests to imageProxy.do.
xyImgUrl values containing non-HTTP schemes such as file://, gopher://, dict://, or ftp://.

Detection Strategies

Deploy web application firewall rules that inspect xyImgUrl and block private IP ranges, metadata endpoints, and non-HTTP schemes.
Correlate access logs for imageProxy.do with egress network telemetry from the hosting server to surface anomalous fetch behavior.
Alert on repeated imageProxy.do requests from a single source enumerating sequential internal IPs or ports.

Monitoring Recommendations

Forward web server, application, and network flow logs to a centralized analytics platform for cross-source correlation.
Baseline expected outbound destinations from the application host and alert on deviations, particularly to metadata IPs.
Track authentication events on the editing system for low-privilege accounts issuing high volumes of proxy requests.

How to Mitigate CVE-2025-2116

Immediate Actions Required

Restrict network access to /newsedit/newsedit/xy/imageProxy.do to trusted internal users via network segmentation or reverse proxy ACLs.
Block egress from the application server to cloud metadata endpoints (169.254.169.254) and internal management ranges not required for operation.
Enforce WAF rules that reject xyImgUrl values referencing private, loopback, or link-local addresses and non-HTTP schemes.

Patch Information

No vendor patch is referenced in the advisory. The vendor was contacted but did not respond to the disclosure. Operators should treat the deployment as unpatched and apply compensating controls. Track the VulDB advisory #299011 for updates.

Workarounds

Place the application behind a reverse proxy that validates outbound proxy destinations and rewrites or drops disallowed URLs.
Run the application in a network segment with strict egress filtering, allowing only required destinations.
Disable or remove the imageProxy.do handler if the image proxy feature is not required for business operations.

bash

# Example nginx rule to block SSRF-prone parameter values
location /newsedit/newsedit/xy/imageProxy.do {
    if ($arg_xyImgUrl ~* "(127\.0\.0\.1|169\.254|10\.|192\.168|172\.(1[6-9]|2[0-9]|3[0-1])|file://|gopher://|dict://)") {
        return 403;
    }
    proxy_pass http://backend;
}