CVE-2025-32013 Overview
A Server-Side Request Forgery (SSRF) vulnerability has been discovered in LNbits, a Lightning wallet and accounts system. The vulnerability exists in LNbits' LNURL authentication handling functionality. When processing LNURL authentication requests, the application accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library with redirect following enabled. The application doesn't properly validate the callback URL, allowing attackers to specify internal network addresses and access internal resources.
Critical Impact
This SSRF vulnerability enables unauthenticated attackers to make arbitrary HTTP requests from the LNbits server, potentially exposing internal services, cloud metadata endpoints, and sensitive infrastructure that should not be accessible from external networks.
Affected Products
- LNbits (all versions prior to patched release)
- LNbits LNURL authentication handler component
- Systems running LNbits with network access to internal resources
Discovery Timeline
- 2025-04-06 - CVE-2025-32013 published to NVD
- 2025-04-08 - Last updated in NVD database
Technical Details for CVE-2025-32013
Vulnerability Analysis
The vulnerability is classified as CWE-918 (Server-Side Request Forgery). SSRF vulnerabilities occur when an application fetches a remote resource based on a user-supplied URL without proper validation. In LNbits, the LNURL authentication flow requires the application to make HTTP callbacks to URLs provided by users. The lack of URL validation allows attackers to abuse this functionality to reach internal network resources that would otherwise be inaccessible from the internet.
The httpx library configuration with redirect following enabled exacerbates the issue, as attackers can potentially chain redirects to bypass basic URL checks and ultimately reach restricted endpoints.
Root Cause
The root cause of this vulnerability is improper input validation in the LNURL authentication callback mechanism. The application fails to implement allowlist-based validation or block requests to private IP address ranges (RFC 1918), localhost addresses, link-local addresses, and cloud provider metadata endpoints. Additionally, the enabled redirect following allows attackers to bypass any superficial URL checks by providing an allowed URL that redirects to a restricted internal address.
Attack Vector
The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:
- Initiating an LNURL authentication request to the LNbits instance
- Providing a malicious callback URL pointing to internal network resources
- The LNbits server makes an HTTP request to the attacker-specified URL
- Internal services respond to the server, and the attacker may receive sensitive data or trigger actions on internal systems
Common attack targets include cloud metadata services (e.g., http://169.254.169.254/), internal APIs, administrative interfaces, and database services that trust connections from the local network.
The vulnerability can be exploited through crafted LNURL authentication requests that specify malicious callback URLs targeting internal infrastructure. Attackers may leverage DNS rebinding techniques or open redirects to bypass basic URL validation if implemented. For detailed technical information about the vulnerability mechanism, see the GitHub Security Advisory.
Detection Methods for CVE-2025-32013
Indicators of Compromise
- Outbound HTTP requests from the LNbits server to internal IP addresses (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
- HTTP requests to cloud metadata endpoints such as 169.254.169.254
- Unusual LNURL authentication callback patterns with internal hostnames or IP addresses
- Failed or successful connections to localhost services (127.0.0.1) from the application
Detection Strategies
- Monitor application logs for LNURL authentication requests containing private IP addresses or localhost references
- Implement network-level monitoring to detect outbound requests from the LNbits server to RFC 1918 addresses
- Deploy web application firewall (WAF) rules to inspect and block SSRF patterns in authentication callbacks
- Use SentinelOne Singularity to detect anomalous network behavior from application processes
Monitoring Recommendations
- Enable detailed logging for all LNURL authentication callback requests including the full callback URL
- Set up alerts for network connections from the LNbits process to internal infrastructure
- Monitor for DNS queries to suspicious domains that may indicate DNS rebinding attempts
- Review authentication logs for unusual patterns or high-volume callback requests
How to Mitigate CVE-2025-32013
Immediate Actions Required
- Update LNbits to the latest patched version as soon as available
- Implement network segmentation to limit the LNbits server's access to internal resources
- Deploy egress filtering rules to block the server from reaching internal IP ranges
- Consider disabling LNURL authentication temporarily if not critical to operations
Patch Information
Refer to the official GitHub Security Advisory for specific patch information and updated versions. Organizations should prioritize applying the security update due to the critical severity of this vulnerability.
Workarounds
- Configure network firewall rules to prevent the LNbits server from initiating connections to private IP address ranges
- Deploy a reverse proxy with URL validation to inspect and sanitize callback URLs before they reach LNbits
- Block access to cloud metadata endpoints (169.254.169.254) at the network level
- Use DNS-based filtering to prevent resolution of internal hostnames from external requests
# Example iptables rules to block SSRF to internal networks
# Apply to the LNbits server to prevent outbound connections to private ranges
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
