CVE-2025-2192: Stoque Zeev.it SSRF Vulnerability

CVE-2025-2192 Overview

CVE-2025-2192 is a Server-Side Request Forgery (SSRF) vulnerability in Stoque Zeev.it version 4.24. The flaw resides in the Login component and is triggered through the /Login?inpLostSession=1 endpoint. Attackers can manipulate the inpRedirectURL parameter to coerce the server into issuing outbound requests to attacker-controlled destinations. The vulnerability is remotely exploitable and requires no authentication, though it requires limited user interaction. Public exploit disclosure has occurred, and the vendor did not respond to disclosure attempts. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated attackers can abuse the inpRedirectURL parameter on the Zeev.it login page to force the application server to issue outbound HTTP requests, enabling internal network probing and potential exposure of internal services.

Affected Products

Stoque Zeev.it 4.24
Login component (/Login?inpLostSession=1)
Deployments exposing the inpRedirectURL parameter

Discovery Timeline

2025-03-11 - CVE-2025-2192 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2192

Vulnerability Analysis

The vulnerability affects the login flow of Stoque Zeev.it 4.24 when the inpLostSession=1 query parameter is present. The application accepts a user-supplied value for inpRedirectURL and processes it server-side without adequate validation of the target host or scheme. This behavior allows attackers to redirect server-initiated requests toward arbitrary URLs, including internal endpoints not intended for external reachability.

SSRF flaws of this nature enable reconnaissance against internal infrastructure, interaction with cloud metadata services, and pivoting through trusted network segments. The public disclosure of exploitation details increases the likelihood of opportunistic scanning against Internet-exposed Zeev.it instances.

Root Cause

The root cause is missing validation and allow-listing of URLs supplied through the inpRedirectURL parameter. The Login page treats the parameter as trusted input and permits the server-side component to fetch or resolve the supplied URL. There is no enforced restriction against internal IP ranges, loopback addresses, or non-HTTP schemes.

Attack Vector

An attacker crafts a URL of the form /Login?inpLostSession=1&inpRedirectURL=<attacker_controlled_target> and induces a victim to load it, or issues the request directly against the exposed endpoint. The application then processes the supplied URL server-side, generating outbound requests observable by the attacker. Because the vector is network-accessible and requires no authentication, exploitation costs are low.

No verified proof-of-concept code is published in the NVD reference set. Technical write-ups are indexed in VulDB entry #299217 and a supplementary shared file.

Detection Methods for CVE-2025-2192

Indicators of Compromise

HTTP requests to /Login?inpLostSession=1 containing an inpRedirectURL parameter pointing to non-application hosts
Outbound connections from the Zeev.it application server to internal IP ranges (RFC1918) or cloud metadata endpoints such as 169.254.169.254
Repeated login-page requests with varied inpRedirectURL values consistent with SSRF probing

Detection Strategies

Inspect web server and reverse-proxy logs for requests to /Login with an inpRedirectURL query parameter containing external or internal URLs unrelated to the application domain
Correlate inbound login-page hits with outbound HTTP traffic from the application host to detect server-initiated fetches triggered by user input
Deploy web application firewall (WAF) rules that flag SSRF-style payloads on the Zeev.it login endpoint

Monitoring Recommendations

Monitor egress traffic from Zeev.it servers and alert on connections to internal management subnets, loopback, or metadata service addresses
Baseline the volume of /Login?inpLostSession=1 requests and alert on statistical anomalies
Retain HTTP access logs with full query strings to support incident investigation and threat hunting

How to Mitigate CVE-2025-2192

Immediate Actions Required

Restrict Internet exposure of the Zeev.it login page to trusted networks or VPN users where operationally feasible
Deploy WAF signatures that block or sanitize the inpRedirectURL parameter when values reference internal IP ranges, loopback, or non-HTTP schemes
Audit outbound firewall rules on Zeev.it application servers to deny egress to internal management interfaces and cloud metadata endpoints

Patch Information

No vendor patch has been published in the referenced advisories. Stoque did not respond to the coordinated disclosure attempt documented in the VulDB submission. Operators should contact the vendor directly for remediation guidance and monitor future Zeev.it releases for a fix addressing the inpRedirectURL handling.

Workarounds

Enforce a strict allow-list at a reverse proxy that permits only expected redirect targets for the inpRedirectURL parameter
Block requests to /Login?inpLostSession=1 that include an inpRedirectURL value pointing outside the application's own hostname
Segment the Zeev.it host into a network zone with no route to internal management services or cloud metadata endpoints

bash

# Example NGINX rule to block external targets in inpRedirectURL
location /Login {
    if ($arg_inpRedirectURL ~* "^(https?://)?(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.)") {
        return 403;
    }
    proxy_pass http://zeevit_backend;
}