CVE-2025-32948: Framasoft PeerTube DoS Vulnerability

CVE-2025-32948 Overview

CVE-2025-32948 is a Server-Side Request Forgery (SSRF) and Denial of Service vulnerability affecting Framasoft PeerTube, a decentralized video hosting platform. The vulnerability allows any unauthenticated attacker to cause the PeerTube server to stop functioning or, in special cases, send requests to arbitrary URLs (Blind SSRF). Attackers can exploit this by sending malicious ActivityPub activities to PeerTube's "inbox" endpoint, abusing the "Create Activity" functionality to create crafted playlists that trigger either denial of service or attacker-controlled blind SSRF.

Critical Impact

Unauthenticated attackers can remotely crash PeerTube servers or leverage blind SSRF to probe internal network resources, potentially leading to service outages and reconnaissance of internal infrastructure.

Affected Products

• Framasoft PeerTube (versions prior to v7.1.1)

Discovery Timeline

• 2025-04-15 - CVE CVE-2025-32948 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-32948

Vulnerability Analysis

This vulnerability exists in PeerTube's handling of ActivityPub protocol messages, specifically within the playlist creation functionality. ActivityPub is the federation protocol that allows PeerTube instances to communicate and share content across the decentralized network. The vulnerability is classified as CWE-843 (Type Confusion), indicating that the application improperly handles data types during the processing of ActivityPub activities.

When an attacker sends specially crafted ActivityPub "Create Activity" messages to the inbox endpoint, the server fails to properly validate the playlist creation request. This allows attackers to exploit the type confusion issue to either crash the server (denial of service) or force the server to make HTTP requests to attacker-specified URLs (blind SSRF).

The blind SSRF component is particularly concerning as it can be leveraged to probe internal network services that would otherwise be inaccessible from the internet, potentially exposing sensitive internal infrastructure information or enabling further attacks against backend services.

Root Cause

The root cause is a type confusion vulnerability (CWE-843) in PeerTube's ActivityPub implementation. The application fails to properly validate and sanitize incoming ActivityPub activity data before processing playlist creation requests. This allows malformed or malicious activity data to be processed in unintended ways, leading to either server crashes or SSRF conditions.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying a target PeerTube instance's ActivityPub inbox endpoint
2. Crafting a malicious ActivityPub "Create Activity" message with a specially constructed playlist payload
3. Sending the crafted message to the target server's inbox endpoint
4. The server processes the malicious activity, resulting in either a denial of service condition or initiating attacker-controlled HTTP requests to arbitrary URLs

The exploitation mechanism involves abusing the federation protocol that PeerTube uses to communicate between instances. Since ActivityPub endpoints are designed to receive messages from external sources, the attack surface is inherently exposed to the internet on any federated PeerTube instance.

Detection Methods for CVE-2025-32948

Indicators of Compromise

• Unusual or malformed ActivityPub activity requests targeting the /inbox endpoint
• Server crashes or unexpected service restarts without apparent cause
• Outbound HTTP requests from the PeerTube server to unexpected internal or external IP addresses
• Elevated error rates in PeerTube logs related to playlist creation or ActivityPub processing

Detection Strategies

• Monitor PeerTube application logs for errors related to ActivityPub activity processing and playlist creation failures
• Implement network monitoring to detect unusual outbound connections from PeerTube servers, especially to internal RFC1918 addresses or metadata endpoints
• Deploy Web Application Firewall (WAF) rules to inspect and filter malformed ActivityPub activity payloads
• Set up alerting for unexpected PeerTube service restarts or crashes

Monitoring Recommendations

• Enable verbose logging on ActivityPub endpoints to capture incoming activity details for forensic analysis
• Implement rate limiting on the inbox endpoint to mitigate DoS attack volume
• Monitor server resource utilization for anomalies that may indicate DoS exploitation attempts
• Review outbound network traffic patterns regularly to identify potential blind SSRF exploitation

How to Mitigate CVE-2025-32948

Immediate Actions Required

• Upgrade PeerTube to version v7.1.1 or later immediately
• Review server logs for any signs of exploitation attempts against the ActivityPub inbox endpoint
• Consider temporarily restricting access to the ActivityPub inbox endpoint if immediate patching is not possible
• Implement network-level controls to limit outbound connections from the PeerTube server

Patch Information

Framasoft has addressed this vulnerability in PeerTube version v7.1.1. The patch includes proper validation of ActivityPub activity data and fixes the type confusion issue that enabled both the denial of service and blind SSRF attack vectors.

For detailed patch information, refer to the GitHub PeerTube Release v7.1.1. Additional technical analysis is available from JFrog's vulnerability research.

Workarounds

• Implement network segmentation to restrict the PeerTube server's ability to make outbound connections to internal resources
• Deploy a reverse proxy with strict input validation for ActivityPub endpoints
• Configure firewall rules to limit outbound connections from the PeerTube server to only necessary external services
• If federation is not required, consider disabling or restricting access to ActivityPub endpoints entirely until patching is complete

# Example: UFW firewall rule to restrict PeerTube outbound connections
# Block outbound to internal networks (adjust for your environment)
sudo ufw deny out from any to 10.0.0.0/8
sudo ufw deny out from any to 172.16.0.0/12
sudo ufw deny out from any to 192.168.0.0/16