CVE-2025-1848
Published: 03 March 2025
Summary
CVE-2025-1848 is a medium-severity SSRF (CWE-918) vulnerability in Zframeworks Zz. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2025-1848 is a server-side request forgery (SSRF) vulnerability, classified as critical, affecting zj1983 zz up to version 2024-8. The issue resides in an unknown function within the file /import_data_check, where manipulation of the url argument enables the SSRF. It is remotely exploitable and associated with CWE-918, with a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-03-03.
A remote attacker with low privileges can exploit this vulnerability by crafting a malicious url argument, potentially forcing the server to make unintended requests. This could lead to limited impacts on confidentiality, integrity, and availability, depending on the internal resources accessible via SSRF.
Advisories from sources like VulDB and GitHub repositories detail the exploit, which has been publicly disclosed and may be actively used. The vendor was contacted early regarding the issue but provided no response, and no patches or specific mitigations are referenced.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5822
Vulnerability details
A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is an unknown function of the file /import_data_check. The manipulation of the argument url leads to server-side request forgery. It is possible to launch the…
more
attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SSRF vulnerability (CWE-918) in the public-facing /import_data_check endpoint enables exploitation of public-facing applications (T1190) and facilitates network service discovery (T1046) by allowing remote attackers to forge server-side requests to internal/intranet resources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly validates the manipulated 'url' argument in /import_data_check to block server-side request forgery by ensuring inputs conform to expected safe values.
Enforces flow control policies to restrict the application's ability to make unauthorized internal or external requests triggered by the SSRF vulnerability.
Monitors and controls communications at system boundaries to block or detect anomalous outbound requests initiated by the SSRF exploitation.