Rocket TRUfusion Enterprise is a secure file collaboration and sharing platform used by enterprises in industries like automotive, aerospace, and manufacturing. It facilitates seamless data exchange across departments and organizations, ensuring compliance with rigorous security standards. IT administrators deploy it to manage large volumes of proprietary information and documentation, integrating with existing enterprise systems to maintain efficient workflows. The platform's role in handling sensitive data makes its security critical for business continuity.
The Server-Side-Request-Forgery (SSRF) vulnerability, identified as CVE-2025-32355, arises from a misconfiguration in the reverse proxy component of Rocket TRUfusion Enterprise. This flaw allows the server to process absolute URLs in incoming HTTP requests, enabling an attacker to trick the server into making unauthorized requests to internal or external resources. The vulnerability stems from insufficient validation of request parameters, particularly in how the proxy handles URL forwarding.
Technically, the vulnerability is exploited through the reverse proxy's handling of HTTP requests that include absolute URLs in the request line or headers. By sending a crafted request to the proxy, an attacker can force the server to connect to arbitrary destinations, such as internal network services or cloud metadata endpoints. The specific endpoint targeted is the proxy's request routing function, which fails to sanitize user-supplied URLs before forwarding them.
If exploited, this SSRF vulnerability can lead to severe consequences, including unauthorized access to internal systems, data exfiltration, and potential lateral movement within the network. Attackers could leverage the server's trust to interact with internal APIs, databases, or cloud services, compromising sensitive information and disrupting operations. The CVSS score of 7.0 reflects the high impact on confidentiality and integrity, emphasizing the need for immediate remediation.
- Update Rocket TRUfusion Enterprise to the latest version that includes a fix for the reverse proxy configuration vulnerability.
- Review and correct reverse proxy settings to ensure it does not process or forward absolute URLs from incoming requests.
- Implement strict input validation for all HTTP request parameters, especially those affecting URL routing.
- Restrict outbound network access from the server to only necessary internal and external services using firewall rules.
- Enable detailed logging and monitoring for unusual outbound requests originating from the proxy component.
- Conduct regular security audits and penetration testing focused on SSRF attack vectors.
- Apply the principle of least privilege to the server's network permissions to limit potential damage from exploitation.
- Educate IT administrators on secure proxy configuration practices to prevent similar misconfigurations.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →