{"id":86174,"date":"2025-12-31T23:01:56","date_gmt":"2025-12-31T23:01:56","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-32013-ssrf-vulnerability-in-lnbits-lnurl-authentication-handling-functionality","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-32013-ssrf-vulnerability-in-lnbits-lnurl-authentication-handling-functionality\/","title":{"rendered":"CVE-2025-32013: SSRF Vulnerability in LNbits’ LNURL Authentication Handling Functionality<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report discusses a significant Server Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-32013, within the LNbits’ LNURL authentication handling functionality. This vulnerability poses a potential threat to system security and data confidentiality. It affects all entities utilizing LNbits, a popular Lightning wallet and accounts system. The vulnerability allows unauthorized access to internal network addresses, thereby compromising system data.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-32013
\nSeverity: High (CVSS Score 7.5)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: System compromise and potential data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

LNbits | All versions prior to patched release<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The LNbits’ LNURL authentication handling functionality processes authentication requests without properly validating the callback URL. It accepts a callback URL parameter and makes an HTTP request to that URL using the httpx library. With redirect following enabled, an attacker can manipulate the callback URL to specify internal network addresses. This allows unauthorized access to internal resources, potentially leading to system compromise and data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Here is a hypothetical example of how the vulnerability might be exploited using a malicious HTTP request:<\/p>\n

GET \/lnurl-auth?callback=http:\/\/internal-network-resource HTTP\/1.1\nHost: vulnerable-lnbits-server<\/code><\/pre>\n
In this example, the attacker specifies an internal network resource as the callback URL. The LNbits server, failing to validate the URL, makes a request to this internal resource, potentially exposing sensitive information or functionality to the attacker.<\/p>\n
Mitigation Guidance<\/strong><\/p>\n
To mitigate the potential impact of this vulnerability, users are advised to apply the vendor patch as soon as it becomes available. In the interim, implementing a Web Application Firewall (WAF) or Intrusion Detection System (IDS) may serve as a temporary mitigation strategy. These systems can help detect and prevent malicious requests exploiting this vulnerability.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report discusses a significant Server Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-32013, within the LNbits’ LNURL authentication handling functionality. This vulnerability poses a potential threat to system security and data confidentiality. It affects all entities utilizing LNbits, a popular Lightning wallet and accounts system. The vulnerability allows unauthorized access to internal network […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86174","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t