CVE-2025-32355 Scanner
This scanner targets the reverse proxy configuration in Rocket TRUfusion Enterprise to detect SSRF flaws, enabling attackers to send arbitrary HTTP requests from the server.
Short Info
Level
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
1 minute
Time Interval
20 days 17 hours
Scan only one
Domain, Subdomain, IPv4
Toolbox
Rocket TRUfusion Enterprise is a secure file collaboration and sharing platform used by enterprises in industries like automotive, aerospace, and manufacturing. It facilitates seamless data exchange across departments and organizations, ensuring compliance with rigorous security standards. IT administrators deploy it to manage large volumes of proprietary information and documentation, integrating with existing enterprise systems to maintain efficient workflows. The platform's role in handling sensitive data makes its security critical for business continuity.
The Server-Side-Request-Forgery (SSRF) vulnerability, identified as CVE-2025-32355, arises from a misconfiguration in the reverse proxy component of Rocket TRUfusion Enterprise. This flaw allows the server to process absolute URLs in incoming HTTP requests, enabling an attacker to trick the server into making unauthorized requests to internal or external resources. The vulnerability stems from insufficient validation of request parameters, particularly in how the proxy handles URL forwarding.
Technically, the vulnerability is exploited through the reverse proxy's handling of HTTP requests that include absolute URLs in the request line or headers. By sending a crafted request to the proxy, an attacker can force the server to connect to arbitrary destinations, such as internal network services or cloud metadata endpoints. The specific endpoint targeted is the proxy's request routing function, which fails to sanitize user-supplied URLs before forwarding them.
If exploited, this SSRF vulnerability can lead to severe consequences, including unauthorized access to internal systems, data exfiltration, and potential lateral movement within the network. Attackers could leverage the server's trust to interact with internal APIs, databases, or cloud services, compromising sensitive information and disrupting operations. The CVSS score of 7.0 reflects the high impact on confidentiality and integrity, emphasizing the need for immediate remediation.
