CVE-2025-45869 Overview
CVE-2025-45869 is a Server-Side Request Forgery (SSRF) vulnerability affecting LogicalDOC Enterprise versions up to and including v9.1.1. The flaw resides in the ShareFileCallback servlet, which fails to validate user-supplied input before initiating outbound HTTP requests. An unauthenticated attacker can manipulate request parameters to force the server to send requests to an attacker-controlled host. This behavior maps to CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can abuse the LogicalDOC server as a proxy to reach internal network resources, cloud metadata services, and other restricted endpoints not exposed to the public internet.
Affected Products
- LogicalDOC Enterprise versions up to and including v9.1.1
- Deployments exposing the ShareFileCallback servlet to untrusted networks
- Instances running without upstream network egress controls
Discovery Timeline
- 2026-07-13 - CVE-2025-45869 published to NVD
- 2026-07-13 - Last updated in NVD database
Technical Details for CVE-2025-45869
Vulnerability Analysis
The vulnerability exists in the ShareFileCallback servlet exposed by LogicalDOC Enterprise. The servlet accepts input parameters that are used to construct a server-side HTTP request without sufficient validation of the destination host or scheme. An unauthenticated remote attacker can supply an arbitrary URL and cause the LogicalDOC application server to issue a request on their behalf.
Because the request originates from the server, it inherits the server's network position. Attackers can reach hosts behind perimeter firewalls, query cloud instance metadata endpoints, and probe internal services that would otherwise be unreachable. The impact aligns with the CIA impact profile of low confidentiality, integrity, and availability effects, reflecting information disclosure and limited pivoting rather than direct code execution.
See the GitHub Vulnerability Disclosure for the reporter's technical write-up.
Root Cause
The root cause is missing validation of user-controlled URL parameters passed to the ShareFileCallback handler. The servlet does not restrict outbound requests to an allowlist of trusted hosts or verify that the target is a legitimate sharing endpoint. Any parseable URL is forwarded to the underlying HTTP client.
Attack Vector
The vulnerability is exploitable over the network without authentication or user interaction. An attacker sends a crafted HTTP request to the ShareFileCallback endpoint on an exposed LogicalDOC Enterprise instance. The manipulated parameter directs the server to fetch content from an attacker-controlled URL or an internal target. Attackers commonly abuse this pattern to enumerate internal services, retrieve cloud metadata credentials, or exfiltrate data through DNS and HTTP callbacks.
No verified public proof-of-concept code is included in the enriched data. Refer to the linked disclosure for reproduction details.
Detection Methods for CVE-2025-45869
Indicators of Compromise
- Inbound HTTP requests to the ShareFileCallback servlet containing URL-like parameter values pointing to external, internal RFC1918, or link-local addresses such as 169.254.169.254.
- Outbound connections from the LogicalDOC application server to unexpected destinations, including cloud metadata endpoints or newly registered domains.
- Application logs showing repeated ShareFileCallback invocations from a single unauthenticated source over a short time window.
Detection Strategies
- Deploy web application firewall (WAF) rules that inspect ShareFileCallback parameters and block values containing internal IP ranges, localhost, or metadata service hostnames.
- Correlate LogicalDOC access logs with egress firewall logs to identify server-initiated requests immediately following unauthenticated servlet calls.
- Baseline normal outbound destinations for the LogicalDOC host and alert on deviations, particularly requests to cloud metadata IPs or non-corporate domains.
Monitoring Recommendations
- Enable verbose logging on the LogicalDOC servlet container to capture full request URIs and client IPs for ShareFileCallback.
- Forward application and egress network telemetry into a centralized SIEM or data lake for cross-source correlation.
- Monitor DNS query logs from the LogicalDOC server for lookups of attacker-controlled or unusual external domains.
How to Mitigate CVE-2025-45869
Immediate Actions Required
- Upgrade LogicalDOC Enterprise to a version later than v9.1.1 that addresses the SSRF flaw. Consult the LogicalDOC vendor site for current release information.
- Restrict network access to the LogicalDOC management interface and ShareFileCallback endpoint to trusted networks and authenticated users only.
- Enforce strict egress filtering from the LogicalDOC server, denying outbound traffic to internal address ranges and cloud metadata IPs by default.
Patch Information
As of the NVD publication date, no vendor patch URL is listed in the enriched data. Administrators should contact LogicalDOC support and monitor the official LogicalDOC site for a fixed release addressing CVE-2025-45869.
Workarounds
- Place LogicalDOC behind a reverse proxy or WAF configured to block requests to ShareFileCallback from untrusted sources until a patch is applied.
- Implement an outbound proxy that enforces an allowlist of permitted destinations for the LogicalDOC server process.
- On cloud deployments, enable Instance Metadata Service v2 (IMDSv2) or equivalent controls to prevent SSRF-based credential theft from metadata endpoints.
# Example iptables egress restriction on the LogicalDOC host
# Block outbound requests to cloud metadata and RFC1918 ranges
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
