CVE-2025-48739: StrangeBee TheHive SSRF Vulnerability

CVE-2025-48739 Overview

CVE-2025-48739 is a Server-Side Request Forgery (SSRF) vulnerability affecting StrangeBee TheHive, a security incident response platform. The flaw exists in versions 5.2.0 before 5.2.16, 5.3.0 before 5.3.11, 5.4.0 before 5.4.10, and 5.5.0 before 5.5.1. Remote authenticated attackers holding administrator permissions can manipulate URLs on specific API endpoints to redirect server-side requests to arbitrary hosts or ports. The TheHive server then acts as a proxy, giving attackers a foothold to reach internal or otherwise restricted network resources. The issue is tracked under [CWE-918] Server-Side Request Forgery.

Critical Impact
An authenticated administrator can pivot through the TheHive server to reach internal services, cloud metadata endpoints, or other restricted network resources that are not directly reachable from the internet.

Affected Products

StrangeBee TheHive 5.2.0 before 5.2.16
StrangeBee TheHive 5.3.0 before 5.3.11
StrangeBee TheHive 5.4.0 before 5.4.10
StrangeBee TheHive 5.5.0 before 5.5.1

Discovery Timeline

2025-05-23 - CVE CVE-2025-48739 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48739

Vulnerability Analysis

TheHive exposes API endpoints that accept URLs as input and dispatch outbound HTTP requests from the server. The affected endpoints do not sufficiently validate or restrict the destination host, scheme, or port before issuing the request. An authenticated administrator can supply a URL pointing to an internal address such as 127.0.0.1, 169.254.169.254, or an internal IP range, and the TheHive backend will fetch that resource on the attacker's behalf.

Because the request originates from the TheHive server, it inherits any network trust granted to that host. This enables reconnaissance of internal services, interaction with cloud instance metadata services, and potential exploitation of unauthenticated internal APIs. Administrator credentials are required, which reduces exposure but does not eliminate risk in environments where admin accounts are shared, compromised, or granted broadly.

Root Cause

The root cause is missing egress URL validation in API handlers that perform server-initiated HTTP requests. TheHive does not enforce an allowlist of destination hosts or block requests to loopback, link-local, and private address ranges. This class of flaw is categorized as [CWE-918] Server-Side Request Forgery.

Attack Vector

Exploitation requires network access to the TheHive API and valid administrator credentials. The attacker sends a crafted request to a vulnerable API endpoint with a URL parameter pointing to an internal target. TheHive resolves the URL and issues the request from its own network context, returning response data or side effects to the attacker. Refer to the StrangeBeeCorp Security Advisory SB-SEC-ADV-2025-002 for endpoint-level technical details.

Detection Methods for CVE-2025-48739

Indicators of Compromise

Outbound HTTP requests from the TheHive server process to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses.
API access logs showing administrator calls to endpoints that accept URL parameters with unusual host values or non-standard ports.
Unexpected connections from TheHive to cloud metadata services such as 169.254.169.254.

Detection Strategies

Correlate TheHive application logs with network flow data to identify server-initiated requests targeting non-public destinations.
Alert on administrator API activity that includes URL parameters resolving to private, loopback, or metadata service addresses.
Baseline normal outbound destinations for the TheHive host and flag deviations.

Monitoring Recommendations

Forward TheHive API access logs and host network telemetry to a centralized analytics platform for correlation.
Monitor administrator account usage patterns and flag privileged API calls from unusual source IPs or at unusual times.
Track DNS resolutions initiated by the TheHive service account and alert on lookups of internal-only names from unexpected code paths.

How to Mitigate CVE-2025-48739

Immediate Actions Required

Upgrade TheHive to a fixed release: 5.2.16, 5.3.11, 5.4.10, or 5.5.1 or later.
Audit administrator accounts and remove or rotate credentials that are no longer required.
Review recent administrator API activity for suspicious URL parameters or outbound requests to internal destinations.

Patch Information

StrangeBee has released fixed versions 5.2.16, 5.3.11, 5.4.10, and 5.5.1 that address the SSRF condition. Full remediation details are published in the StrangeBeeCorp Security Advisory SB-SEC-ADV-2025-002. Apply the upgrade path appropriate for your current branch.

Workarounds

Restrict egress network access from the TheHive server using host or perimeter firewall rules that block outbound connections to internal ranges, loopback, and cloud metadata addresses.
Limit administrative access to TheHive to a small, well-audited set of accounts protected with multi-factor authentication.
Place TheHive in a network segment that cannot directly reach sensitive internal services or cloud metadata endpoints.

bash

# Example egress restriction using iptables on the TheHive host
# Block outbound requests from TheHive to cloud metadata and internal ranges
iptables -A OUTPUT -m owner --uid-owner thehive -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner thehive -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -m owner --uid-owner thehive -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner thehive -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner thehive -d 192.168.0.0/16 -j REJECT