PT-2025-9538 · Openziti · Openziti

Diabl0-Sec · Published 2025-03-03 · Updated 2025-03-05 · CVE-2025-27501

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenZiti versions prior to 3.7.1

Description The issue concerns an endpoint on the admin panel that can be accessed without authentication. This endpoint accepts a user-supplied URL parameter to connect to an OpenZiti Controller, which can lead to a Server-Side Request Forgery (SSRF) vulnerability. The SSRF vulnerability allows an attacker to perform server-side requests, potentially exploiting the identity of the node to gain additional permissions.

Recommendations For versions prior to 3.7.1, update to version 3.7.1 to fix the vulnerability, as it moves the request to the external controller from the server side to the client side, eliminating the potential for SSRF exploitation.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-27501

GHSA-FQXH-VFV5-8QJP

Affected Products

Openziti

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27501.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27501 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27501 · Vendor Advisory
• https://github.com/openziti/ziti-console/security/advisories/GHSA-fqxh-vfv5-8qjp · Note
• https://twitter.com/CVEnew/status/1896767585724538912 · Twitter Post
• https://t.me/cvenotify/113227 · Telegram Post
• https://t.me/cvedetector/19394 · Telegram Post
• https://twitter.com/dailycve/status/1897400761216278796 · Twitter Post