CVE-2025-27501: OpenZiti SSRF Vulnerability

CVE-2025-27501 Overview

CVE-2025-27501 is a Server-Side Request Forgery (SSRF) vulnerability affecting OpenZiti, a free and open source project focused on bringing zero trust to any application. An endpoint on the admin panel can be accessed without any form of authentication and accepts a user-supplied URL parameter to connect to an OpenZiti Controller. This results in the server performing requests on behalf of an attacker, potentially exposing internal network resources and sensitive information.

Critical Impact

Unauthenticated attackers can exploit this SSRF vulnerability to access internal services, enumerate internal infrastructure, and potentially exfiltrate sensitive data from systems that trust the OpenZiti node's identity.

Affected Products

• OpenZiti versions prior to 3.7.1
• OpenZiti Ziti Console admin panel
• OpenZiti Controller integration endpoints

Discovery Timeline

• 2025-03-03 - CVE-2025-27501 published to NVD
• 2025-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27501

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery). The OpenZiti admin console contains an endpoint that fails to implement proper authentication controls. When accessed, this endpoint accepts a user-controlled URL parameter intended for connecting to an OpenZiti Controller. The server then performs requests to the specified URL using its own network identity and permissions.

The core issue stems from the architectural decision to perform controller connections server-side rather than client-side. This design choice inadvertently allows attackers to leverage the server's network position and trust relationships to access resources that would otherwise be inaccessible from external networks.

Root Cause

The root cause of this vulnerability lies in two compounding issues:

1. Missing Authentication: The vulnerable endpoint lacks any form of authentication mechanism, allowing anonymous access to a sensitive administrative function.

2. Server-Side Request Processing: The application architecture performs HTTP requests to user-supplied URLs from the server side, inheriting all network access and trust relationships of the OpenZiti node itself.

This combination allows unauthenticated external attackers to use the OpenZiti server as a proxy to reach internal network resources, cloud metadata services, and other sensitive endpoints.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft malicious requests to the vulnerable endpoint, specifying arbitrary URLs as the connection target. The OpenZiti server then initiates connections to these URLs, potentially returning responses containing sensitive data. Common SSRF attack targets include:

• Internal network services and APIs
• Cloud provider metadata endpoints (e.g., 169.254.169.254)
• Localhost services running on the OpenZiti host
• Internal configuration and management interfaces

Since the vulnerability exists in a zero-trust networking solution, successful exploitation could be particularly damaging as attackers may gain access to resources protected by the zero-trust architecture itself.

Detection Methods for CVE-2025-27501

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests originating from the OpenZiti server to internal IP ranges
• Access logs showing unauthenticated requests to the admin panel controller connection endpoint
• Network traffic from the OpenZiti node to cloud metadata services or localhost addresses
• Unexpected data transfers or responses containing internal infrastructure information

Detection Strategies

• Monitor web server access logs for requests to the vulnerable admin panel endpoint from external or suspicious IP addresses
• Implement network-level detection for SSRF patterns, including requests to private IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) and cloud metadata IPs
• Deploy web application firewall (WAF) rules to detect and block URL parameters containing internal network addresses
• Configure alerts for any unauthenticated access attempts to administrative endpoints

Monitoring Recommendations

• Enable detailed logging for all admin panel access and controller connection attempts
• Implement egress filtering to monitor and restrict outbound connections from the OpenZiti server
• Review historical logs for evidence of exploitation attempts or successful SSRF attacks
• Deploy SentinelOne Singularity Platform for real-time behavioral analysis and threat detection on systems running OpenZiti

How to Mitigate CVE-2025-27501

Immediate Actions Required

• Upgrade OpenZiti to version 3.7.1 or later immediately
• Restrict network access to the admin panel from trusted IP addresses only
• Implement authentication requirements for all administrative endpoints if not already in place
• Review firewall rules to limit outbound connections from the OpenZiti server to only necessary destinations

Patch Information

The OpenZiti development team has addressed this vulnerability in version 3.7.1. The fix relocates the controller connection request from the server side to the client side, eliminating the ability for attackers to leverage the server's network identity and permissions. Organizations should upgrade to this version or later as soon as possible.

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Implement network segmentation to restrict the OpenZiti server's ability to reach sensitive internal resources
• Configure a reverse proxy or WAF in front of the admin panel to filter and validate incoming requests
• Deploy egress filtering rules to prevent the server from connecting to internal networks or cloud metadata endpoints
• Temporarily disable the vulnerable admin panel endpoint if it is not required for operations until the patch can be applied