CVE-2025-67427: Evershop Blind SSRF Vulnerability

CVE-2025-67427 Overview

A Blind Server-Side Request Forgery (SSRF) vulnerability has been identified in EverShop, an open-source Node.js e-commerce platform. The vulnerability exists in the GET /images API endpoint and allows unauthenticated attackers to force the server to initiate arbitrary HTTP or HTTPS requests to internal and external networks. This occurs due to insufficient validation of the src query parameter, which accepts arbitrary URIs without proper sanitization.

Critical Impact

Unauthenticated attackers can leverage this SSRF vulnerability to probe internal network infrastructure, access cloud metadata services, bypass firewall restrictions, and potentially exfiltrate sensitive data from otherwise inaccessible internal resources.

Affected Products

• EverShop version 2.1.0
• EverShop versions prior to 2.1.0
• All EverShop deployments with the /images API endpoint exposed

Discovery Timeline

• 2026-01-05 - CVE-2025-67427 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2025-67427

Vulnerability Analysis

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), a critical web application security flaw that allows attackers to abuse server functionality to make requests on behalf of the vulnerable application. In the case of EverShop, the /images API endpoint is designed to fetch and serve images but fails to properly validate the source URL provided by users.

The blind nature of this SSRF means that while attackers cannot directly view the response content from the server-side request, they can still infer information through timing-based analysis, error messages, or by directing requests to attacker-controlled servers to confirm connectivity. This makes detection more challenging but does not diminish the potential impact of the vulnerability.

Root Cause

The root cause of this vulnerability lies in the insufficient input validation of the src query parameter in the /images API endpoint. The application accepts user-supplied URLs without implementing proper URL scheme restrictions, domain allowlisting, or network boundary enforcement. This allows attackers to specify arbitrary HTTP or HTTPS URIs that the server will attempt to fetch.

The vulnerable code path processes the src parameter directly without:

• Validating the URL scheme (allowing http:// and https://)
• Implementing a domain allowlist
• Blocking requests to private IP ranges (RFC 1918 addresses)
• Preventing requests to localhost or loopback addresses
• Filtering cloud metadata service endpoints

Attack Vector

The attack is network-based and requires no authentication, making it highly accessible to remote attackers. An attacker can craft malicious requests to the vulnerable endpoint by manipulating the src query parameter to target internal resources.

Typical attack scenarios include:

1. Internal Network Scanning: Attackers can probe internal IP ranges to discover running services and open ports by analyzing response times and error patterns.

2. Cloud Metadata Service Access: In cloud environments (AWS, GCP, Azure), attackers may attempt to access instance metadata endpoints like http://169.254.169.254/latest/meta-data/ to retrieve sensitive credentials and configuration data.

3. Firewall Bypass: Since requests originate from the trusted EverShop server, attackers can reach internal services that would otherwise be protected by network-level access controls.

4. Port Scanning: By targeting specific ports on internal hosts, attackers can map the internal network architecture without direct access.

For detailed technical information and proof-of-concept details, refer to the CVE-2025-67427 PoC repository.

Detection Methods for CVE-2025-67427

Indicators of Compromise

• Unusual outbound HTTP/HTTPS requests from the EverShop server to internal IP ranges (10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x)
• Requests to cloud metadata endpoints originating from the application server (e.g., requests to 169.254.169.254)
• High volume of requests to the /images endpoint with varying src parameters targeting different IP addresses or ports
• Connection attempts from the web server to localhost or loopback addresses on non-standard ports

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block requests containing internal IP addresses or cloud metadata URLs in the src parameter
• Monitor and alert on outbound network connections from the EverShop application server to internal network ranges
• Deploy network-level detection for unexpected traffic patterns from web servers to internal infrastructure
• Analyze application logs for suspicious patterns in /images API requests, particularly those with unusual URL schemes or internal network targets

Monitoring Recommendations

• Enable detailed access logging for the /images API endpoint and review logs for suspicious src parameter values
• Configure network monitoring tools to alert on any connections from the EverShop server to cloud metadata IP addresses
• Set up alerts for failed connection attempts from the application server to internal network segments
• Implement rate limiting on the /images endpoint to slow down potential scanning attempts

How to Mitigate CVE-2025-67427

Immediate Actions Required

• Review and restrict access to the /images API endpoint through network-level controls until a patch is applied
• Implement web application firewall rules to block requests with internal IP addresses, localhost, or cloud metadata URLs in the src parameter
• Configure network egress filtering to prevent the EverShop server from initiating connections to internal networks or sensitive endpoints
• Audit application logs for any signs of prior exploitation attempts

Patch Information

At the time of publication, no official patch has been released by the EverShop maintainers. Organizations should monitor the EverShop GitHub repository for security updates and apply patches as soon as they become available. In the interim, implementing the workarounds described below is strongly recommended.

Workarounds

• Implement a reverse proxy or WAF rule to validate and sanitize the src parameter before requests reach the application
• Deploy network segmentation to isolate the EverShop server from sensitive internal resources
• Block outbound connections from the application server to private IP ranges (RFC 1918) and cloud metadata endpoints at the network level
• Consider disabling the /images endpoint if it is not essential for business operations until an official patch is available

# Example nginx configuration to block SSRF attempts
# Add to server block handling EverShop
location /images {
    # Block requests with internal IP addresses in src parameter
    if ($arg_src ~* "(localhost|127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)") {
        return 403;
    }
    
    # Proxy to EverShop application
    proxy_pass http://evershop_backend;
}