Overview
A critical vulnerability, identified as CVE-2025-36845, has been discovered in Eveo URVE Web Manager, version 27.02.2025. This vulnerability, a Server-Side Request Forgery (SSRF), poses a significant risk to any organization using the affected software due to its potential for system compromise and data leakage. Given the high CVSS severity score of 8.6, immediate action is required to mitigate this risk and protect sensitive data and systems from potential exploitation.
Vulnerability Summary
CVE ID: CVE-2025-36845
Severity: Critical (CVSS 8.6)
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
Eveo URVE Web Manager | Version 27.02.2025
How the Exploit Works
The vulnerability resides in the /_internal/redirect.php endpoint. This endpoint accepts a URL as an input, sends a request to this address, and then reflects the content in the response. Attackers can exploit this by providing a URL of a sensitive internal resource, which would normally be unreachable from the outside network, leading to SSRF. This allows the attacker to bypass firewalls and gain access to the internal network, potentially leading to system compromise or data leakage.
Conceptual Example Code
The following is a conceptual HTTP request that demonstrates how an attacker might exploit this vulnerability:
GET /_internal/redirect.php?url=http://internal-sensitive-resource HTTP/1.1
Host: vulnerable.example.com
Content-Type: application/jsonThe “url” parameter is manipulated to request a sensitive internal resource that should not be accessible from outside. The server then performs the request and returns the response, giving the attacker access to the sensitive data.
Mitigation and Prevention
Organizations are advised to apply the vendor-supplied patch immediately. If this is not possible, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation against the exploit. Regularly updating and patching systems is critical for maintaining a strong security posture.