Listen to this Post
How the CVE Works
CVE-2025-0292 is an SSRF vulnerability in Ivanti Connect Secure (before 22.7R2.8) and Ivanti Policy Secure (before 22.7R1.5). An authenticated admin attacker can manipulate server-side requests to interact with internal network services. The flaw arises from improper input validation when processing HTTP requests, allowing crafted URLs to bypass security controls. Attackers can abuse this to scan internal networks, access sensitive systems, or pivot to higher-privileged environments. The vulnerability leverages the application’s ability to relay requests to unintended backend services, exposing unpatched instances to data exfiltration or lateral movement.
DailyCVE Form
Platform: Ivanti Connect Secure
Version: < 22.7R2.8
Vulnerability: SSRF
Severity: Critical
Date: 07/15/2025
Prediction: Patch expected by 08/10/2025
What Undercode Say
curl -X POST -d "url=internal-service" https://target/admin/api nmap --script http-ssrf target
How Exploit
1. Authenticate as admin.
2. Craft malicious HTTP request with internal URL.
3. Server processes request, exposing internal services.
Protection from this CVE
- Upgrade to 22.7R2.8/22.7R1.5.
- Restrict admin API access.
- Network segmentation.
Impact
- Internal network exposure.
- Data exfiltration.
- Privilege escalation.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
