CVE-2025-2245 Overview
CVE-2025-2245 is a server-side request forgery (SSRF) vulnerability in the Bitdefender GravityZone Update Server when configured in Relay Mode. The flaw resides in the HTTP proxy component listening on port 7074, which enforces a domain allowlist for outbound requests. The allowlist logic fails to sanitize hostnames containing null-byte (%00) sequences, allowing attackers to bypass the restriction. A crafted request to a hostname such as evil.com%00.bitdefender.com is treated as trusted while being forwarded to attacker-controlled destinations. This weakness maps to CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated network attackers can pivot through the Relay proxy to reach arbitrary internal or external systems, exposing internal services that are normally unreachable from outside the perimeter.
Affected Products
- Bitdefender GravityZone Update Server (Relay Mode)
- HTTP proxy component on TCP port 7074
- Endpoint installations configured to route updates through a Relay
Discovery Timeline
- 2025-04-04 - CVE-2025-2245 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-2245
Vulnerability Analysis
The GravityZone Update Server operating in Relay Mode exposes an HTTP proxy on port 7074 so that managed endpoints can fetch signatures and product updates through a central intermediary. To prevent the relay from being abused as an open proxy, the component validates the destination hostname against a domain allowlist limited to Bitdefender infrastructure.
The validation routine performs the allowlist check on the raw hostname string without stripping or rejecting embedded null bytes. Downstream HTTP client logic then truncates or interprets the hostname differently, resolving a different host than the one evaluated by the allowlist. This parser differential is the core defect behind CVE-2025-2245.
Because the vulnerable service is reachable over the network without authentication, an attacker who can send TCP traffic to port 7074 can issue proxied requests to arbitrary destinations. See the Bitdefender Security Advisory for vendor details.
Root Cause
The root cause is inconsistent hostname parsing between the allowlist check and the request-forwarding logic. The allowlist matches the suffix .bitdefender.com on the full string, while URL handling treats %00 as a string terminator or delimiter. The two components disagree on what constitutes the authoritative hostname.
Attack Vector
An attacker crafts an HTTP request to the relay on port 7074 with a Host header or URL of the form evil.com%00.bitdefender.com. The allowlist sees a .bitdefender.com suffix and permits the request. The proxy resolves and connects to evil.com, returning the response through the relay. The same technique can target internal RFC1918 addresses reachable from the relay, enabling reconnaissance and interaction with unauthenticated internal services.
No verified exploit code has been published. The vulnerability is described in prose per the vendor advisory rather than with a proof-of-concept payload.
Detection Methods for CVE-2025-2245
Indicators of Compromise
- Outbound connections from a GravityZone Relay host to destinations outside the expected Bitdefender update infrastructure.
- HTTP requests on port 7074 containing %00 or literal null bytes inside the Host header or request URI.
- DNS resolutions initiated by the Relay for domains that do not belong to bitdefender.com or configured mirrors.
- Unexpected connections from the Relay to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254.
Detection Strategies
- Inspect proxy and firewall logs for URL-encoded null bytes (%00) or unusual characters in requests directed at port 7074.
- Baseline the set of remote hosts the Relay contacts and alert on new or non-Bitdefender destinations.
- Correlate Relay egress traffic with internal asset access to identify lateral reconnaissance patterns typical of SSRF abuse.
Monitoring Recommendations
- Enable verbose HTTP access logging on the Update Server and forward logs to a central SIEM for retention and analytics.
- Monitor connection attempts from the Relay to internal management interfaces, cloud metadata services, and previously unseen external IPs.
- Alert on any process on the Relay host that initiates outbound sockets to non-approved destinations.
How to Mitigate CVE-2025-2245
Immediate Actions Required
- Apply the fixed GravityZone Update Server build referenced in the Bitdefender Security Advisory VA-12646.
- Restrict inbound access to TCP port 7074 so that only managed endpoints on trusted network segments can reach the Relay.
- Constrain the Relay's egress with a host-based or perimeter firewall to permit only Bitdefender update domains and required IP ranges.
Patch Information
Bitdefender has issued a corrected version of the GravityZone Update Server that sanitizes null-byte sequences in hostnames before the allowlist check. Administrators should confirm the installed Update Server version against the fixed release identified in the vendor advisory and update via the standard GravityZone update workflow.
Workarounds
- Where patching is delayed, disable Relay Mode on servers that do not require it and route endpoints directly to Bitdefender infrastructure.
- Place the Relay on an isolated network segment with no route to internal management planes, database servers, or cloud metadata services.
- Add web application firewall or reverse proxy rules in front of port 7074 to reject requests containing %00 or non-printable characters in the Host header or URI.
# Example iptables restriction limiting port 7074 to trusted endpoint subnets
iptables -A INPUT -p tcp --dport 7074 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7074 -j DROP
# Example egress restriction for the Relay host
iptables -A OUTPUT -o eth0 -d update.bitdefender.com -j ACCEPT
iptables -A OUTPUT -o eth0 -m owner --uid-owner bdupdate -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
