CVE-2025-5327: Chshcms Mccms SSRF Vulnerability

CVE-2025-5327 Overview

CVE-2025-5327 is a Server-Side Request Forgery (SSRF) vulnerability affecting chshcms mccms version 2.7. The flaw resides in the index function of the sys/apps/controllers/api/Gf.php file. Attackers manipulate the pic argument to coerce the server into issuing arbitrary outbound HTTP requests. The vulnerability is exploitable remotely and requires only low-privilege authentication. Public exploit details have been disclosed, and the vendor did not respond to disclosure attempts. The issue is categorized under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated remote attackers can use the affected mccms instance as a proxy to access internal network resources, cloud metadata endpoints, or otherwise unreachable services.

Affected Products

chshcms mccms 2.7
File: sys/apps/controllers/api/Gf.php
Function: index (parameter pic)

Discovery Timeline

2025-05-29 - CVE-2025-5327 published to the National Vulnerability Database (NVD)
2025-06-10 - Last updated in NVD database

Technical Details for CVE-2025-5327

Vulnerability Analysis

The vulnerability exists in the index action of the Gf.php API controller in chshcms mccms 2.7. The controller accepts a user-supplied pic parameter and uses it to construct an outbound request without sufficient validation of the destination URL. An attacker submits a URL pointing to internal hosts, loopback interfaces, or cloud instance metadata endpoints. The application server then performs the request on the attacker's behalf and may return response data or side effects to the caller.

SSRF in this context allows reconnaissance of internal services, port scanning behind perimeter controls, and retrieval of sensitive metadata. In cloud-hosted deployments, attackers can target the 169.254.169.254 metadata service to extract temporary credentials. The vendor was contacted prior to public disclosure but did not respond.

Root Cause

The root cause is missing or insufficient validation of the pic parameter inside the index function of sys/apps/controllers/api/Gf.php. The controller treats the parameter as a trusted URL and forwards it to an HTTP client without enforcing an allowlist of hosts, schemes, or address ranges. No filtering blocks private network ranges (RFC 1918), link-local addresses, or non-HTTP schemes.

Attack Vector

Exploitation is performed over the network against the public API endpoint exposed by mccms. An attacker with low-privileged access submits a crafted request where the pic parameter contains a URL referencing an internal resource. The server resolves and fetches that URL, enabling indirect access to assets that are not directly reachable from the internet. Public exploitation details are available in the referenced GitHub SSRF Exploit Code and VulDB entry #310497.

The vulnerability mechanism involves passing an attacker-controlled URL through the pic parameter to a server-side fetch routine, with no destination validation. See the external references for technical proof-of-concept details.

Detection Methods for CVE-2025-5327

Indicators of Compromise

Inbound HTTP requests to api/Gf or api/Gf/index containing a pic parameter with non-image URLs, internal IP addresses, or metadata endpoints such as 169.254.169.254.
Outbound connections from the mccms web server to internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback (127.0.0.1).
Web server access logs showing the pic argument referencing schemes other than http:// or https://, including file://, gopher://, or dict://.
Anomalous DNS resolutions originating from the mccms host targeting attacker-controlled domains.

Detection Strategies

Inspect web access logs for requests to sys/apps/controllers/api/Gf.php (or routed equivalent) where pic contains a URL rather than an image filename.
Monitor egress traffic from the mccms server and alert on connections to private address space, link-local addresses, or cloud metadata IPs.
Deploy a web application firewall rule to flag pic parameter values matching URL patterns or private IP literals.

Monitoring Recommendations

Enable verbose request logging on the PHP application server and forward logs to a centralized SIEM for correlation.
Track outbound HTTP user-agent strings associated with PHP curl or file_get_contents traffic from the mccms host.
Alert on repeated 4xx and 5xx responses from internal services that follow inbound pic parameter activity, which can indicate scanning.

How to Mitigate CVE-2025-5327

Immediate Actions Required

Restrict network egress from the mccms application server using firewall rules that block private address ranges and cloud metadata endpoints.
Place the api/Gf endpoint behind authentication checks and reduce its exposure to untrusted networks until a patch is available.
Apply a web application firewall rule that rejects requests where the pic parameter contains a URL scheme or internal IP literal.
Audit web server logs for prior exploitation attempts referencing the pic parameter.

Patch Information

No official vendor patch is available. The vendor was contacted but did not respond to disclosure. Operators should monitor the VulDB advisory #310497 for updates and consider migrating to a maintained CMS if the vendor remains unresponsive.

Workarounds

Disable or remove the sys/apps/controllers/api/Gf.php controller if the functionality is not required for production use.
Modify the index function to validate the pic argument against an allowlist of permitted external image hosts and reject any non-HTTP(S) schemes.
Force outbound requests from the application through an egress proxy that enforces destination allowlisting and blocks RFC 1918 ranges.
Disable IMDSv1 on cloud instances and enforce IMDSv2 with hop-limit restrictions to reduce metadata exposure.

bash

# Example egress restriction using iptables to block metadata and private ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT