CVE-2025-52362
Published: 21 July 2025
Summary
CVE-2025-52362 is a critical-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement).
Deeper analysis
CVE-2025-52362, published on 2025-07-21, is a Server-Side Request Forgery (SSRF) vulnerability classified under CWE-918 in the URL processing functionality of PHProxy version 1.1.1 and prior. The issue stems from inadequate input validation for the _proxurl parameter, which can be bypassed by attackers submitting malicious input.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by its CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). Successful exploitation allows the attacker to submit a specially crafted URL, potentially leading to high confidentiality and integrity impacts through unauthorized server-side requests.
Mitigation details and additional information are available in the referenced advisories, including a Gist at https://gist.github.com/Shulelk/a18c11866be8609b22ff5df780a42422 and the PHProxy GitHub repository at https://github.com/PHProxy/phproxy.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22144
Vulnerability details
Server-Side Request Forgery (SSRF) vulnerability exists in the URL processing functionality of PHProxy version 1.1.1 and prior. The input validation for the _proxurl parameter can be bypassed, allowing a remote, unauthenticated attacker to submit a specially crafted URL
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing PHProxy directly matches exploitation of a public-facing application (T1190) via crafted external requests.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the core issue of inadequate input validation for the _proxurl parameter by requiring comprehensive checks on URL inputs to block SSRF exploitation.
Monitors and controls communications at system boundaries to block or detect unauthorized outbound requests triggered by SSRF to internal resources.
Enforces information flow control policies to restrict server-side requests from reaching unauthorized destinations exploited via SSRF.