CVE-2025-2835: Zhyd Oneblog SSRF Vulnerability

CVE-2025-2835 Overview

CVE-2025-2835 is a server-side request forgery (SSRF) vulnerability in zhangyd-c OneBlog versions up to 2.3.9. The flaw resides in the autoLink function of com/zyd/blog/controller/RestApiController.java. An authenticated remote attacker can manipulate the affected parameter to coerce the server into issuing arbitrary outbound HTTP requests. Public disclosure has occurred, and exploit details have been published through VulDB and the project's GitHub issue tracker. The weakness maps to [CWE-918] Server-Side Request Forgery.

Critical Impact
Authenticated attackers can abuse the autoLink API to send crafted requests from the OneBlog server, enabling internal network reconnaissance and access to services otherwise unreachable from the internet.

Affected Products

zhangyd-c OneBlog versions up to and including 2.3.9
Component: com/zyd/blog/controller/RestApiController.java (autoLink function)
Vendor: zhyd (OneBlog project)

Discovery Timeline

2025-03-27 - CVE-2025-2835 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2835

Vulnerability Analysis

OneBlog exposes a REST API endpoint backed by the autoLink method in RestApiController.java. The endpoint accepts a URL parameter and fetches remote content on behalf of the caller, typically to generate link previews or auto-embed content. Because the handler does not validate or restrict the destination host, an authenticated user can supply arbitrary URLs. The server then issues outbound requests to attacker-chosen destinations, including internal IP ranges, loopback interfaces, and cloud metadata endpoints. The disclosure classifies the impact as limited to integrity, consistent with an SSRF that returns response data or side effects rather than direct code execution.

Root Cause

The root cause is missing destination validation in the autoLink handler. The controller trusts user-supplied URLs and passes them directly to an HTTP client without enforcing an allowlist, blocking private address ranges, or restricting URL schemes. This design pattern is a canonical [CWE-918] SSRF condition.

Attack Vector

Exploitation requires network access to the OneBlog API and low-privilege authentication. An attacker submits a request to the autoLink endpoint containing a URL that points to an internal service, such as http://127.0.0.1:8080/actuator, http://169.254.169.254/latest/meta-data/, or an internal admin console. The OneBlog server issues the request from its own network position, potentially reaching hosts that are not exposed externally. Attackers commonly chain SSRF to enumerate internal services, retrieve cloud instance credentials, or pivot to unauthenticated internal APIs. No verified proof-of-concept code is published; the vulnerability details are described in the OneBlog GitHub issue and VulDB entry #301471.

Detection Methods for CVE-2025-2835

Indicators of Compromise

Outbound HTTP requests originating from the OneBlog application server to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
Access log entries showing requests to the autoLink API endpoint containing URLs with non-standard schemes (file://, gopher://) or internal hostnames.
Unexpected authentication attempts or configuration reads on internal services shortly after autoLink API activity.

Detection Strategies

Inspect OneBlog access logs for calls to the autoLink endpoint and correlate the supplied URL parameter against an allowlist of expected external domains.
Deploy egress network monitoring on the OneBlog host to flag connections destined for private IP ranges or metadata services.
Add web application firewall (WAF) rules that reject requests to autoLink when the URL parameter resolves to a private, loopback, or link-local address.

Monitoring Recommendations

Enable structured logging of outbound HTTP client activity from the OneBlog JVM to capture destination hosts and response codes.
Alert on repeated autoLink invocations from the same authenticated session, which may indicate scanning behavior.
Review cloud provider audit logs for anomalous metadata service queries from the OneBlog instance.

How to Mitigate CVE-2025-2835

Immediate Actions Required

Restrict access to the OneBlog autoLink API endpoint using authentication controls and network-level allowlists.
Apply egress firewall rules that block the OneBlog application server from initiating connections to internal subnets and cloud metadata endpoints.
Audit user accounts on the OneBlog instance and disable any low-privilege accounts that do not require API access.

Patch Information

At the time of publication, no vendor advisory or fixed release is listed in the NVD entry. Track the upstream GitHub issue for a coordinated fix. Until a patched version is released, apply the workarounds below and consider forking the project to patch the autoLink handler locally with strict URL validation.

Workarounds

Modify or disable the autoLink handler in RestApiController.java to enforce an allowlist of permitted destination domains and reject non-HTTP(S) schemes.
Resolve the user-supplied URL and verify that it does not map to loopback, link-local, or RFC1918 addresses before issuing the outbound request.
Place the OneBlog application behind a reverse proxy that terminates SSRF payloads and enforces outbound request policies.

bash

# Example iptables egress restriction for the OneBlog host
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 169.254.0.0/16 -j REJECT