CVE-2025-2997: Zhangyanbo2007 Youkefu SSRF Vulnerability

CVE-2025-2997 Overview

CVE-2025-2997 is a Server-Side Request Forgery (SSRF) vulnerability in zhangyanbo2007 youkefu version 4.2.0. The flaw resides in an unknown function within the /res/url endpoint. Attackers can manipulate the url argument to coerce the application into issuing arbitrary outbound HTTP requests. The vulnerability is classified under CWE-918 and is exploitable remotely over the network with low privileges. A public exploit document has been disclosed, increasing the likelihood of opportunistic exploitation against exposed instances.

Critical Impact
Remote authenticated attackers can abuse the /res/url endpoint to pivot into internal networks, query cloud metadata services, and probe non-public services from the trusted youkefu host.

Affected Products

zhangyanbo2007 youkefu 4.2.0
Component: zhangyanbo2007:youkefu
CPE: cpe:2.3:a:zhangyanbo2007:youkefu:4.2.0

Discovery Timeline

2025-03-31 - CVE-2025-2997 published to NVD
2025-10-10 - Last updated in NVD database

Technical Details for CVE-2025-2997

Vulnerability Analysis

The youkefu application exposes a /res/url endpoint that accepts a user-controlled url parameter. The server fetches the supplied URL without validating the destination host, scheme, or IP address. This behavior allows attackers to redirect server-issued requests to arbitrary internal or external resources. SSRF flaws of this type [CWE-918] are commonly leveraged to reach services bound to localhost, internal management APIs, and cloud instance metadata endpoints such as 169.254.169.254. Because the request originates from the application server, network controls that trust internal traffic may permit access that external clients cannot achieve. The EPSS probability is 0.413% (percentile 32.73), indicating moderate near-term exploitation likelihood.

Root Cause

The root cause is missing input validation and allow-listing on the url parameter handler. The application accepts any URL string and passes it directly to an HTTP client without restricting destinations to expected external resources. There is no scheme filtering, no DNS rebinding protection, and no block list for private IP ranges.

Attack Vector

An attacker sends an HTTP request to /res/url with the url parameter pointing to a target of choice. Targets include internal HTTP services, cloud metadata endpoints, and out-of-band hosts used to confirm blind SSRF. The exploit requires low privileges and no user interaction. The public proof-of-concept document is hosted in the exp3n5ive Vul repository and demonstrates the parameter manipulation against the vulnerable endpoint.

No verified exploit code is available in trusted sources. See the VulDB entry #302046 for additional technical context.

Detection Methods for CVE-2025-2997

Indicators of Compromise

Inbound HTTP requests to /res/url containing url= parameters referencing private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8) or link-local addresses (169.254.169.254).
Outbound connections from the youkefu application host to internal services that the application does not normally contact.
Requests to /res/url with non-HTTP schemes such as file://, gopher://, or dict://.
Anomalous DNS lookups from the youkefu host for attacker-controlled out-of-band domains.

Detection Strategies

Deploy web application firewall rules that inspect the url parameter on /res/url and reject requests targeting private, loopback, or metadata addresses.
Correlate application access logs with egress firewall logs to identify SSRF pivots originating from the youkefu host.
Hunt for repeated /res/url requests from the same source where the url value enumerates internal hostnames or ports.

Monitoring Recommendations

Forward youkefu access logs and host egress telemetry to a centralized analytics platform for correlation.
Alert on any request to cloud instance metadata endpoints originating from the application host.
Track outbound HTTP request volume per endpoint and alert on spikes from /res/url handlers.

How to Mitigate CVE-2025-2997

Immediate Actions Required

Restrict network access to the youkefu /res/url endpoint until a patched version is available.
Apply egress filtering on the youkefu host to block traffic to internal network ranges and cloud metadata IPs.
Require authentication and rate limiting on /res/url to reduce abuse from low-privileged accounts.
Review historical access logs for prior exploitation attempts referencing internal targets.

Patch Information

No vendor advisory or fixed version is listed in the NVD record at publication time. Track the VulDB CTI entry and the upstream youkefu project for remediation updates. Until a fix is released, treat the /res/url endpoint as untrusted and isolate the host.

Workarounds

Block external access to /res/url at the reverse proxy or load balancer layer.
Implement an allow-list of permitted destination hostnames in a request filter in front of the application.
Reject url parameter values that resolve to private, loopback, link-local, or multicast IP addresses after DNS resolution.
Disable URL schemes other than http and https in the upstream HTTP client configuration.

bash

# Example NGINX rule to block private-range targets in the url parameter
location /res/url {
    if ($arg_url ~* "(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.|localhost|file://|gopher://|dict://)") {
        return 403;
    }
    proxy_pass http://youkefu_backend;
}