CVE-2025-4012: Playeduos Playedu SSRF Vulnerability

CVE-2025-4012 Overview

CVE-2025-4012 is a Server-Side Request Forgery (SSRF) vulnerability in playeduxyz PlayEdu 开源培训系统 versions up to 1.8. The flaw resides in the User Avatar Handler component and is reachable through the /api/backend/v1/user/create endpoint. Manipulation of the Avatar argument allows an authenticated attacker to coerce the server into issuing arbitrary outbound requests. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts. The weakness is tracked under CWE-918.

Critical Impact
Authenticated attackers can abuse the avatar upload parameter to issue server-side HTTP requests to internal hosts, enabling reconnaissance of internal services and potential interaction with non-public endpoints.

Affected Products

playeduxyz PlayEdu 开源培训系统 versions up to and including 1.8
Deployments exposing the /api/backend/v1/user/create API endpoint
Instances using the default User Avatar Handler component

Discovery Timeline

2025-04-28 - CVE-2025-4012 published to the National Vulnerability Database (NVD)
2025-05-12 - Last updated in NVD database

Technical Details for CVE-2025-4012

Vulnerability Analysis

The vulnerability stems from improper validation of user-controlled input passed as the Avatar argument when creating a user through the /api/backend/v1/user/create API. The application treats the supplied value as a remote resource location and performs a server-side fetch without validating the destination. This pattern matches the classic CWE-918 Server-Side Request Forgery weakness. Attackers can substitute arbitrary URLs to internal IP ranges, cloud metadata services, or non-HTTP endpoints depending on the underlying HTTP client behavior.

Exploitation requires high privileges (an authenticated backend user) but no user interaction. Successful requests do not return high-confidentiality data directly, but they expose limited integrity impact by allowing the server to act on behalf of the attacker. Public exploit information is referenced in the associated GitHub CVE Issue Discussion and VulDB CTI ID #306365.

Root Cause

The root cause is missing allow-list validation of the Avatar parameter before the server initiates an outbound network request to retrieve the resource. The handler trusts the URL scheme, host, and path provided by the API caller and does not constrain destinations to expected storage domains.

Attack Vector

The attack is network-reachable and remotely initiated against the backend API. An authenticated actor submits a crafted user-creation request where the Avatar field references an attacker-chosen URL such as an internal service, cloud metadata endpoint, or external collaborator host. The PlayEdu server then issues an HTTP request to that destination from its own network context.

No verified proof-of-concept code is published in the enriched data. Public disclosure details are available in the GitHub CVE Issue Discussion and VulDB submission #558283.

Detection Methods for CVE-2025-4012

Indicators of Compromise

Outbound HTTP requests originating from the PlayEdu application server to internal RFC1918 addresses, link-local ranges, or cloud metadata IPs such as 169.254.169.254.
POST requests to /api/backend/v1/user/create containing Avatar values with non-standard schemes (file://, gopher://) or unexpected hostnames.
Application logs showing avatar fetch operations against domains outside the configured object storage provider.

Detection Strategies

Inspect web access logs for /api/backend/v1/user/create calls and correlate Avatar parameter values against an allow-list of expected upload sources.
Monitor egress traffic from PlayEdu hosts for unusual destinations, particularly to internal subnets or cloud metadata services.
Alert on user-creation events generated by accounts that do not normally manage user provisioning.

Monitoring Recommendations

Forward PlayEdu application logs and host network telemetry into a centralized analytics platform for correlation across API calls and egress flows.
Baseline normal outbound destinations for the application server and flag deviations.
Track authentication events for backend administrator accounts to identify credential abuse that may precede SSRF exploitation.

How to Mitigate CVE-2025-4012

Immediate Actions Required

Restrict access to the /api/backend/v1/user/create endpoint to trusted administrator networks via reverse proxy or WAF rules.
Block outbound traffic from PlayEdu application servers to internal management ranges and cloud metadata endpoints at the network layer.
Rotate backend administrator credentials and review existing accounts with permission to create users.

Patch Information

No vendor patch is referenced in the enriched data. The vendor did not respond to the disclosure attempt. Operators should monitor the playeduxyz project repository for any future fix and apply it once published.

Workarounds

Deploy a web application firewall rule that rejects requests to /api/backend/v1/user/create when the Avatar field contains URLs outside an approved domain list.
Place the PlayEdu backend behind an egress proxy that enforces destination allow-listing and drops requests to private address space.
Disable or limit the avatar URL feature where feasible, requiring direct file uploads instead of remote URL fetches.

bash

# Example egress filtering with iptables to block SSRF to internal ranges
iptables -A OUTPUT -m owner --uid-owner playedu -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner playedu -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner playedu -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner playedu -d 169.254.0.0/16 -j REJECT