A critical server-side request forgery vulnerability in Eveo URVE Web Manager 27.02.2025 allows unauthenticated attackers to access restricted internal network endpoints.

The application is susceptible to a server-side request forgery (SSRF) attack via the /_internal/redirect.php endpoint. An unauthenticated attacker can supply a malicious URL to this parameter, causing the server to perform requests on their behalf to internal resources that are otherwise unreachable from the public internet.

This vulnerability poses a significant risk to internal network security by effectively bypassing perimeter firewalls. Successful exploitation allows an attacker to interact with internal services, potentially leading to the exposure of sensitive data or the discovery of internal network topology. Given the CVSS score of 8.6, this flaw is categorized as high severity and requires immediate attention to prevent unauthorized internal reconnaissance or potential lateral movement.

Immediate Action: Contact the vendor immediately to obtain the necessary security patches or configuration guidance to disable the vulnerable redirect functionality.

Proactive Monitoring: Review web server access logs for requests directed to /_internal/redirect.php, specifically monitoring for unusual URL parameters that point to internal IP addresses or private network ranges.

Compensating Controls: Implement strict egress filtering on the application server to prevent outbound connections to unauthorized internal subnets, and deploy a Web Application Firewall (WAF) to block requests to the identified vulnerable endpoint.

Public Exploit Available: No (a Nuclei detection template exists, but no weaponized exploit or public proof-of-concept is currently available).

The risk posed by this SSRF vulnerability is substantial due to the ease of exploitation and the potential for internal network exposure. Security teams must prioritize identifying all instances of URVE Web Manager within the environment and apply vendor-provided mitigations as soon as they become available. Until a formal patch is applied, restricting access to the affected endpoint at the network or application level is essential to maintain security posture.