Listen to this Post
The CVE-2025-22399 vulnerability is a blind server-side request forgery (SSRF) flaw in Dell UCC Edge version 2.3.0, specifically within the ‘Add Customer SFTP Server’ functionality. An unauthenticated attacker with local network access can exploit this by sending crafted HTTP requests to the application’s vulnerable endpoint. The issue stems from insufficient validation of user-supplied input in parameters used to configure SFTP servers, such as hostname or URL fields. When processing these inputs, the application fails to sanitize or restrict allowed URLs, enabling attackers to inject malicious addresses. This causes the server to make arbitrary HTTP requests to internal or external systems designated by the attacker. Since the responses from these requests are not returned to the attacker, it is classified as blind SSRF. However, exploitation can be detected through side-channel techniques like observing timing delays, error messages, or out-of-band interactions to attacker-controlled servers. For instance, an attacker might set the SFTP server URL to an internal IP address and port to scan for open services, or to a external server they monitor for incoming connections. This can lead to information disclosure about internal network topology, active services, and potential further attacks. The local access requirement limits the attack vector to the same network segment, but within that scope, it poses a significant risk. The vulnerability highlights a lack of proper input validation and URL filtering in the application’s code path for adding SFTP servers. Attackers typically use tools like curl or burp suite to send manipulated POST requests with embedded malicious URLs. Successful exploitation does not require authentication, making it easier to leverage. Dell has acknowledged the vulnerability and is working on a patch to address this security gap.
Platform: Dell UCC Edge
Version: 2.3.0
Vulnerability: Blind SSRF
Severity: Medium
Date: 2025-02-11
Prediction: Patch by 2025-05-31
What Undercode Say:
Analytics:
curl -X POST http://target/api/sftp/add -d “server=http://internal-ip:port”
nc -lvp 9090
time curl -s “http://target/api/sftp/add?url=http://localhost:22”
how Exploit:
Craft malicious request to Add SFTP Server endpoint with internal URL. Monitor out-of-band interactions for success.
Protection from this CVE:
Apply Dell patch. Restrict network access. Implement input validation.
Impact:
Internal network reconnaissance. Information disclosure. Potential denial of service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
