CVE-2025-32355: Rocket TRUfusion Enterprise SSRF Vulnerability

CVE-2025-32355 Overview

CVE-2025-32355 is a Server-Side Request Forgery (SSRF) vulnerability affecting Rocket TRUfusion Enterprise through version 7.10.4.0. The application uses a reverse proxy to handle incoming connections; however, the proxy is misconfigured in a way that allows attackers to specify absolute URLs in the HTTP request line. This misconfiguration causes the proxy to load and return arbitrary external or internal resources on behalf of the attacker.

Critical Impact

Attackers can exploit this SSRF vulnerability to access internal network resources, bypass security controls, and potentially pivot to other systems within the network infrastructure.

Affected Products

• Rocket TRUfusion Enterprise through version 7.10.4.0

Discovery Timeline

• 2026-02-17 - CVE-2025-32355 published to NVD
• 2026-02-18 - Last updated in NVD database

Technical Details for CVE-2025-32355

Vulnerability Analysis

This vulnerability stems from an improper configuration of the reverse proxy component within Rocket TRUfusion Enterprise. The reverse proxy is designed to handle incoming HTTP connections and route them appropriately within the application. However, due to the misconfiguration, the proxy fails to properly validate and restrict the URLs specified in HTTP request lines.

When an attacker crafts an HTTP request containing an absolute URL (rather than a relative path), the reverse proxy interprets this as a legitimate request and fetches the specified resource. This behavior enables Server-Side Request Forgery attacks, where the proxy server can be weaponized to make requests to arbitrary destinations on behalf of the attacker.

The implications of this vulnerability are significant in enterprise environments where TRUfusion Enterprise is deployed. Attackers could leverage this SSRF to probe internal network infrastructure, access cloud metadata services, interact with internal APIs, or exfiltrate sensitive data from systems that would otherwise be inaccessible from external networks.

Root Cause

The root cause of CVE-2025-32355 is improper input validation in the reverse proxy configuration. The proxy does not adequately sanitize or validate the request line of incoming HTTP requests, specifically failing to reject or rewrite absolute URLs. This allows the proxy to be directed to fetch resources from arbitrary locations, effectively turning it into an open proxy or SSRF vector.

Attack Vector

An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the Rocket TRUfusion Enterprise server. Instead of providing a standard relative path in the request line, the attacker includes an absolute URL pointing to the target resource they wish to access. The misconfigured reverse proxy processes this request and fetches the specified resource, returning the response to the attacker.

This technique can be used to:

• Access internal network services that are not directly exposed to the internet
• Probe internal infrastructure for additional vulnerabilities
• Bypass firewall rules and network segmentation controls
• Access cloud instance metadata services in cloud-hosted environments
• Interact with internal REST APIs or administrative interfaces

For detailed technical information about exploitation of this vulnerability, refer to the RCESecurity CVE-2025-32355 Advisory.

Detection Methods for CVE-2025-32355

Indicators of Compromise

• HTTP request logs showing absolute URLs in the request line instead of relative paths
• Unusual outbound connections from the TRUfusion Enterprise server to internal network addresses or external hosts
• Requests targeting cloud metadata endpoints (e.g., 169.254.169.254) originating from the proxy server
• Anomalous traffic patterns indicating internal network reconnaissance

Detection Strategies

• Monitor HTTP access logs for requests containing absolute URLs with external or internal IP addresses
• Implement network monitoring to detect unexpected outbound connections from the TRUfusion Enterprise server
• Deploy web application firewall (WAF) rules to detect and block SSRF patterns in HTTP request lines
• Analyze proxy server logs for unusual request patterns indicating exploitation attempts

Monitoring Recommendations

• Enable verbose logging on the reverse proxy component to capture full request lines
• Configure alerts for outbound connections from the TRUfusion Enterprise server to unusual destinations
• Implement DNS query monitoring to detect potential SSRF-based data exfiltration
• Regularly review access logs for patterns consistent with SSRF exploitation

How to Mitigate CVE-2025-32355

Immediate Actions Required

• Review and update the reverse proxy configuration to reject absolute URLs in HTTP request lines
• Implement network segmentation to limit the internal resources accessible from the TRUfusion Enterprise server
• Deploy WAF rules to block requests containing absolute URLs in the request line
• Restrict outbound network access from the TRUfusion Enterprise server to only necessary destinations

Patch Information

Contact Rocket Software for the latest security patches and updated versions of TRUfusion Enterprise. Refer to the Rocket Software Product Overview for vendor support and upgrade information. Monitor the RCESecurity Advisory for additional remediation guidance.

Workarounds

• Configure the reverse proxy to explicitly deny requests containing absolute URLs in the request line
• Implement egress filtering on network firewalls to restrict outbound connections from the TRUfusion Enterprise server
• Place the TRUfusion Enterprise server in a restricted network segment with limited access to internal resources
• Deploy a web application firewall in front of the application to filter malicious requests

# Example: Network egress filtering recommendation
# Restrict outbound connections from TRUfusion server
# Apply firewall rules to limit destination addresses
# Allow only necessary external endpoints

# iptables example (adjust for your environment)
iptables -A OUTPUT -m owner --uid-owner trufusion -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner trufusion -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner trufusion -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner trufusion -d 169.254.169.254 -j DROP