CVE-2025-55007: Eng Knowage SSRF Vulnerability

CVE-2025-55007 Overview

CVE-2025-55007 is a server-side request forgery (SSRF) vulnerability in Knowage, an open source analytics and business intelligence suite maintained by Engineering Group. Versions prior to 8.1.37 allow attackers to send crafted requests to arbitrary hosts and paths through the application. The attacker cannot read the response, which limits data exfiltration impact. However, the flaw enables reconnaissance of internal networks that would otherwise be unreachable from the internet. Version 8.1.37 addresses the issue. The vulnerability is tracked under CWE-918.

Critical Impact
Unauthenticated attackers can abuse the Knowage server to probe internal network resources and map services behind the perimeter.

Affected Products

Eng Knowage versions prior to 8.1.37
Knowage Server open source distribution
Deployments exposing the Knowage web interface to untrusted networks

Discovery Timeline

2025-09-01 - CVE-2025-55007 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55007

Vulnerability Analysis

The vulnerability is a blind SSRF in the Knowage server. The application accepts a user-controlled URL and dispatches an HTTP request to it without validating the destination host or scheme. Because the response body is not returned to the caller, the flaw is classified as blind SSRF. Attackers cannot directly read internal service responses. They can still infer service availability from timing differences, connection behavior, and error signals returned by the application. This lets an attacker enumerate hosts, open ports, and internal services from the perspective of the Knowage server.

Root Cause

The root cause is missing validation of a URL parameter used by a server-side HTTP client. Knowage does not restrict outbound requests to an allow-list of trusted destinations. It also does not block requests to loopback, link-local, or RFC1918 address ranges. The issue maps to CWE-918: Server-Side Request Forgery.

Attack Vector

An attacker sends a request to a vulnerable Knowage endpoint containing a URL that references an internal target. The server issues the outbound request using its own network position and privileges. By varying the target host and port, an attacker can map internal infrastructure, identify cloud metadata endpoints, and locate management interfaces. No authentication or user interaction is required. See the Knowage GitHub Security Advisory for vendor-provided technical detail.

No verified proof-of-concept code is publicly available, and no exploitation in the wild has been reported.

Detection Methods for CVE-2025-55007

Indicators of Compromise

Outbound HTTP or HTTPS connections from the Knowage server to internal RFC1918 ranges that do not match normal integration patterns.
Repeated outbound requests from Knowage to sequential IP addresses or ports, indicating scanning behavior.
Requests from Knowage to cloud metadata endpoints such as 169.254.169.254.
Application logs showing user-supplied URLs targeting localhost, loopback interfaces, or link-local addresses.

Detection Strategies

Inspect Knowage HTTP access logs for request parameters containing URL values with internal, loopback, or metadata hostnames.
Correlate web application logs with egress firewall logs to identify unexpected server-initiated connections.
Baseline the set of destinations Knowage normally contacts and alert on deviations.
Deploy web application firewall rules that flag requests where URL parameters resolve to private address space.

Monitoring Recommendations

Enable and centralize Knowage application, servlet container, and reverse proxy logs.
Monitor DNS resolutions performed by the Knowage host for internal or metadata hostnames.
Track connection attempts from the Knowage server to ports associated with management interfaces such as 22, 3306, 5432, 6379, and 9200.

How to Mitigate CVE-2025-55007

Immediate Actions Required

Upgrade Knowage to version 8.1.37 or later on all servers.
Inventory all Knowage instances, including staging and development, and confirm patch status.
Restrict outbound network access from Knowage hosts to only the destinations required for integrations.
Review recent application and egress logs for signs of internal scanning originating from Knowage.

Patch Information

Engineering Group released the fix in Knowage 8.1.37. Patch details and remediation guidance are published in the Knowage Security Advisory GHSA-7f6m-ph57-52w6. Administrators should apply the upgrade following the vendor's standard update procedure and validate configuration after deployment.

Workarounds

Place Knowage behind a forward proxy that enforces an allow-list of permitted outbound destinations.
Use host firewall rules to block outbound traffic from Knowage to 127.0.0.0/8, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 except where required.
Disable cloud instance metadata service access from the Knowage host, or enforce IMDSv2 where applicable.

bash

# Example egress restriction using iptables on the Knowage host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner knowage -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner knowage -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner knowage -j DROP