CVE-2025-5140: Seeyon Zhiyuan OA SSRF Vulnerability

CVE-2025-5140 Overview

CVE-2025-5140 is a server-side request forgery (SSRF) vulnerability affecting Seeyon Zhiyuan OA Web Application System versions up to 8.1 SP2. The flaw resides in the this.oursNetService.getData function within com\ours\www\ehr\openPlatform1\open4ClientType\controller\ThirdMenuController.class. Attackers can manipulate the url argument to force the server to issue arbitrary HTTP requests on their behalf. The vulnerability is exploitable remotely and requires only low-level authentication privileges. The exploit has been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Authenticated remote attackers can abuse the server to reach internal network resources, metadata endpoints, or other backend services otherwise shielded from the public internet.

Affected Products

Seeyon Zhiyuan OA Web Application System 8.0
Seeyon Zhiyuan OA Web Application System 8.1
Seeyon Zhiyuan OA Web Application System 8.1 SP2

Discovery Timeline

2025-05-25 - CVE-2025-5140 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5140

Vulnerability Analysis

The vulnerability is categorized under [CWE-918] Server-Side Request Forgery. The affected component is the ThirdMenuController class, which exposes functionality tied to the Seeyon Zhiyuan OA third-party menu integration platform. The controller invokes this.oursNetService.getData with a url parameter supplied by the client. Because the application does not validate or restrict the destination, the server dispatches HTTP requests to any attacker-controlled host, including internal IP ranges and loopback addresses.

Successful exploitation enables adversaries to probe internal network segments, enumerate services behind the perimeter firewall, and interact with cloud metadata endpoints such as 169.254.169.254. Attackers can also chain SSRF with other weaknesses to pivot deeper into the environment.

Root Cause

The root cause is missing allow-list validation on the url parameter accepted by ThirdMenuController. The server trusts user-supplied destinations and performs outbound HTTP requests without restricting schemes, hosts, or IP ranges. No egress filtering is applied at the application layer.

Attack Vector

An authenticated attacker sends a crafted HTTP request to the vulnerable ThirdMenuController endpoint with the url parameter set to an internal or sensitive target. The server resolves and fetches the attacker-specified URL, returning or acting on the response. Because the attack vector is network-based with low complexity, it can be executed from any system that can reach the OA login portal.

No verified public exploit code is referenced in this advisory. See the VulDB entry #310221 for additional technical context.

Detection Methods for CVE-2025-5140

Indicators of Compromise

Outbound HTTP connections from the Seeyon OA application server to internal subnets, cloud metadata endpoints such as 169.254.169.254, or loopback addresses.
Access log entries containing requests to ThirdMenuController with suspicious or non-standard url parameter values.
Unexpected DNS lookups originating from the OA host targeting attacker-controlled domains or internal hostnames.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect requests to ThirdMenuController and block url parameters referencing private IP ranges, loopback, or cloud metadata services.
Correlate authenticated OA sessions with anomalous outbound traffic patterns from the application server using network flow telemetry.
Review Java application logs for calls to oursNetService.getData with URLs outside the expected third-party integration allow list.

Monitoring Recommendations

Alert on any egress HTTP or HTTPS request from the OA server to RFC1918 ranges, 127.0.0.0/8, or 169.254.0.0/16.
Baseline the normal set of third-party domains the OA integration contacts and flag deviations.
Enable verbose request logging on reverse proxies fronting the OA application to retain full url parameter values for forensic review.

How to Mitigate CVE-2025-5140

Immediate Actions Required

Restrict access to the Seeyon Zhiyuan OA management and integration endpoints to trusted internal networks only.
Enforce strict egress filtering on the OA application server to block connections to internal subnets and cloud metadata endpoints.
Rotate any credentials or tokens accessible from the application server that could be exposed through SSRF-based metadata queries.

Patch Information

As of the last NVD update on 2026-06-17, the vendor had not responded to disclosure and no official patch is referenced in the advisory. Organizations should monitor Seeyon vendor channels for a security update. See VulDB CTI entry #310221 for ongoing tracking.

Workarounds

Deploy a reverse proxy or WAF rule that blocks requests to ThirdMenuController containing url parameters pointing to private, loopback, or link-local addresses.
Implement application-layer egress proxy with an allow list of approved third-party integration domains.
Disable or remove the third-party menu integration feature if it is not required by business workflows.

bash

# Example nginx rule to block SSRF payloads targeting internal ranges
location ~* /ThirdMenuController {
    if ($arg_url ~* "(127\.|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.|169\.254\.|localhost)") {
        return 403;
    }
}