CVE-2025-24354: imgproxy SSRF Vulnerability

CVE-2025-24354 Overview

CVE-2025-24354 is a Server-Side Request Forgery (SSRF) vulnerability in imgproxy, an open-source server for resizing, processing, and converting images. The flaw allows attackers to reach services bound to the local host through the 0.0.0.0 address, even when the IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES configuration is set to false. The loopback protection logic only checked for 127.0.0.0/8 addresses via ip.IsLoopback() and failed to account for the unspecified address 0.0.0.0, which most operating systems route to loopback interfaces. The vulnerability is fixed in imgproxy version 3.27.2.

Critical Impact
Unauthenticated remote attackers can bypass loopback restrictions to interact with internal services running on the imgproxy host, exposing metadata endpoints and internal APIs [CWE-918].

Affected Products

imgproxy versions prior to 3.27.2
Deployments relying on IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES=false for isolation
Container and cloud deployments where imgproxy shares a network namespace with sensitive services

Discovery Timeline

2025-01-27 - CVE-2025-24354 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24354

Vulnerability Analysis

imgproxy fetches source images from URLs supplied by clients. To prevent SSRF against internal services, the application exposes the IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES configuration. When disabled, the source address validator rejects loopback destinations resolved from the supplied hostname.

The validator invoked Go's net.IP.IsLoopback() method, which returns true only for addresses in the 127.0.0.0/8 range. Requests targeting 0.0.0.0 bypassed this check. On Linux and other operating systems, connecting to 0.0.0.0 typically resolves to a service listening on the local host, granting the attacker equivalent access to loopback services.

An attacker can supply a source URL such as http://0.0.0.0:8080/admin and force imgproxy to fetch data from a service intended to be reachable only from the host itself. This exposes cloud metadata endpoints, unauthenticated internal APIs, and administrative interfaces.

Root Cause

The root cause is incomplete input validation in the source address filter. The code checked only ip.IsLoopback() and omitted ip.IsUnspecified(), which covers 0.0.0.0 and ::. The Go standard library treats these categories separately, so the missing predicate created a filter bypass.

Attack Vector

An unauthenticated remote attacker submits a crafted image URL to imgproxy pointing at 0.0.0.0 on a target port. imgproxy resolves and fetches the URL, and the response body reaches the attacker through the image processing pipeline or through error output.

// Patch: security/source.go
// Source: https://github.com/imgproxy/imgproxy/commit/3d4fed6842aa8930ec224d0ad75b0079b858e081
		return ErrInvalidSourceAddress
	}

-	if !config.AllowLoopbackSourceAddresses && ip.IsLoopback() {
+	if !config.AllowLoopbackSourceAddresses && (ip.IsLoopback() || ip.IsUnspecified()) {
		return ErrSourceAddressNotAllowed
	}

The fix extends the check with ip.IsUnspecified(), blocking both 0.0.0.0 and the IPv6 unspecified address :: when loopback sources are disallowed.

Detection Methods for CVE-2025-24354

Indicators of Compromise

imgproxy access logs containing source URLs with hostnames 0.0.0.0, 0, or the IPv6 unspecified address [::]
Outbound HTTP requests from the imgproxy process to local ports hosting metadata or administrative services
Unusual image processing errors correlated with URLs referencing internal port numbers such as 8080, 9090, or 169.254.169.254

Detection Strategies

Parse imgproxy request logs for source URL parameters that resolve to unspecified or private IP ranges before fetching
Deploy egress network monitoring to flag imgproxy connections targeting the host loopback interface or the cloud instance metadata service
Alert on repeated ErrSourceAddressNotAllowed events, which indicate probing after the patch is applied

Monitoring Recommendations

Forward imgproxy container logs and host network flow data to a centralized analytics platform for correlation
Track process-level socket activity for the imgproxy binary to identify unexpected connections to 127.0.0.0/8 or 0.0.0.0
Baseline typical source domains served by imgproxy and alert on deviations that include raw IP literals

How to Mitigate CVE-2025-24354

Immediate Actions Required

Upgrade imgproxy to version 3.27.2 or later across all environments
Audit imgproxy configuration to confirm IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES remains set to false in production
Review recent access logs for source URLs referencing 0.0.0.0 or unspecified addresses and investigate any matches

Patch Information

The fix is committed in imgproxy commit 3d4fed6 and released in version 3.27.2. Refer to GitHub Security Advisory GHSA-j2hp-6m75-v4j4 for the vendor advisory.

Workarounds

Place imgproxy behind a network policy that blocks egress to 127.0.0.0/8, 0.0.0.0, and cloud metadata IPs such as 169.254.169.254
Run imgproxy in a dedicated network namespace or container without co-located sensitive services
Restrict image source URLs to an allowlist of trusted domains using IMGPROXY_ALLOWED_SOURCES

bash

# Configuration example: restrict sources and block local egress
export IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES=false
export IMGPROXY_ALLOWED_SOURCES="https://cdn.example.com/,https://images.example.com/"

# Kubernetes NetworkPolicy egress restriction (excerpt)
# egress:
#   - to:
#       - ipBlock:
#           cidr: 0.0.0.0/0
#           except:
#             - 127.0.0.0/8
#             - 169.254.169.254/32