CVE-2025-25194: Lemmy SSRF Vulnerability via Webfinger

CVE-2025-25194 Overview

CVE-2025-25194 is a Server-Side Request Forgery (SSRF) vulnerability affecting Lemmy, a federated link aggregator and forum for the fediverse. The flaw resides in the activitypub_federation Rust framework that Lemmy depends on for ActivityPub federation. An unauthenticated attacker can abuse a Webfinger request to bypass hardcoded URL path restrictions and anti-Localhost protections. This allows arbitrary HTTP GET requests to any host, port, or URL reachable from the Lemmy server. The issue is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated attacker can force a vulnerable Lemmy instance to issue arbitrary outbound GET requests to internal services, enabling reconnaissance of internal networks and interaction with metadata endpoints or unauthenticated internal APIs.

Affected Products

Lemmy versions 0.19.8 and prior
activitypub_federation Rust crate versions 0.6.2 and prior
Any federated service depending on vulnerable activitypub_federation releases

Discovery Timeline

2025-02-10 - CVE-2025-25194 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25194

Vulnerability Analysis

The vulnerability exists in the Webfinger handling logic within the activitypub_federation crate. Webfinger is a discovery protocol used across ActivityPub implementations to resolve federated actor identifiers to profile URLs. The framework accepts a user-supplied resource identifier and follows the returned link to fetch remote actor data. Input validation on the resolved URL is insufficient to enforce path restrictions or reject loopback and private-range destinations.

As a result, an attacker can craft a Webfinger request that causes the server to issue an outbound HTTP GET to an arbitrary host, port, and path. The server executes the request under its own network identity, granting reachability to internal services that are not exposed to the public internet.

Root Cause

The root cause is missing or bypassable server-side validation of the destination URL used during Webfinger resolution. Hardcoded URL path restrictions and anti-Localhost filters can be evaded through the resource identifier accepted by the Webfinger endpoint. The framework treats the caller-influenced URL as trusted and dispatches a GET request without re-validating the scheme, host, or port against an allowlist.

Attack Vector

The attack is remote and unauthenticated. An attacker sends a crafted Webfinger request to a public Lemmy instance that references a malicious or attacker-controlled resource. The Lemmy server then issues a GET request to a target of the attacker's choosing. Targets typically include cloud instance metadata services, internal administrative dashboards, container orchestration APIs, and other services reachable only from the server's network segment. Response content sensitivity determines the depth of information disclosure; the primary confidentiality impact is limited to what the GET response reveals to the caller.

Refer to the Lemmy GitHub Security Advisory GHSA-7723-35v7-qcxw for the vendor description of the flaw.

Detection Methods for CVE-2025-25194

Indicators of Compromise

Unexpected outbound HTTP GET requests originating from the Lemmy server process to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
Outbound requests from the Lemmy host to cloud metadata endpoints such as 169.254.169.254.
High volumes of Webfinger requests (/.well-known/webfinger?resource=...) from a single source with unusual resource parameters.

Detection Strategies

Inspect reverse proxy and application logs for Webfinger requests carrying resource identifiers that reference non-federation hosts, unusual ports, or IP literals.
Correlate inbound Webfinger requests with outbound connections from the Lemmy process to identify SSRF-driven request chains.
Alert on outbound HTTP requests from application servers targeting RFC1918 addresses, link-local ranges, or non-standard ports.

Monitoring Recommendations

Enable egress logging on the Lemmy server and forward it to a centralized logging platform for retention and analysis.
Monitor cloud provider metadata service access logs (for example, IMDSv2 access counters) for anomalous read activity.
Track federation traffic baselines so that deviations in Webfinger request volume or destination diversity trigger review.

How to Mitigate CVE-2025-25194

Immediate Actions Required

Restrict outbound network access from the Lemmy server to only the destinations required for federation using host firewalls or network policies.
Block outbound access from the Lemmy host to 169.254.169.254 and other cloud metadata endpoints, and enforce IMDSv2 where applicable.
Rate limit inbound Webfinger requests at the reverse proxy to reduce reconnaissance capacity.

Patch Information

At the time of NVD publication, no patched release of activitypub_federation or Lemmy was available. Administrators should track the Lemmy Security Advisory GHSA-7723-35v7-qcxw for fix releases and upgrade to versions superseding activitypub_federation0.6.2 and Lemmy 0.19.8 once published.

Workarounds

Place the Lemmy server behind an egress proxy that enforces a strict allowlist of federation destinations and rejects loopback and private-range targets.
Deploy network segmentation so the Lemmy host cannot reach internal administrative interfaces, databases, or cloud metadata services.
Filter Webfinger resource parameters at the reverse proxy to reject values containing IP literals, non-standard ports, or unexpected schemes.

bash

# Example iptables rules blocking SSRF-relevant destinations from the Lemmy host
iptables -A OUTPUT -m owner --uid-owner lemmy -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemmy -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemmy -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemmy -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner lemmy -d 192.168.0.0/16 -j REJECT