CVE-2025-1849
Published: 03 March 2025
Summary
CVE-2025-1849 is a medium-severity SSRF (CWE-918) vulnerability in Zframeworks Zz. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 33.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2025-1849 is a server-side request forgery (SSRF) vulnerability classified as critical, affecting zj1983 zz up to version 2024-8. The issue resides in an unknown functionality of the /import_data_todb file, where manipulation of the url argument enables the SSRF. It is associated with CWE-918 and carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The vulnerability was published on 2025-03-03.
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows limited impacts on confidentiality, integrity, and availability (C:L/I:L/A:L), potentially enabling the attacker to force the server to make unauthorized requests to internal or external resources.
Advisories from sources like VulDB and GitHub repositories detail the vulnerability but note no vendor response despite early contact. No patches or official mitigations are mentioned; recent entries on VulDB (ctiid.298117, id.298117, submit.505346) confirm the issue without remediation guidance.
The exploit has been publicly disclosed, including proof-of-concept details in GitHub markdown files, increasing the risk of active use against unpatched instances.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-5819
Vulnerability details
A vulnerability classified as critical was found in zj1983 zz up to 2024-8. Affected by this vulnerability is an unknown functionality of the file /import_data_todb. The manipulation of the argument url leads to server-side request forgery. The attack can be…
more
launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The SSRF vulnerability (CWE-918) in the public-facing /import_data_todb endpoint enables exploitation of public-facing applications (T1190) and facilitates internal network service discovery (T1046) through server-side requests to arbitrary internal URLs.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Validates and limits the manipulated 'url' argument in /import_data_todb to prevent injection of malicious URLs enabling SSRF.
Enforces flow control policies restricting the server from initiating unauthorized requests to internal or external resources via SSRF.
Blocks SSRF-induced outbound connections through boundary protections like firewalls or proxies configured to deny access to disallowed destinations.