A critical vulnerability (CVE-2025-1799) has been identified in Zorlan SkyCaiji 2.9, a popular web scraping and data extraction software. This vulnerability affects the previewAction function of the vendor/skycaiji/app/admin/controller/Tool.php file and can lead to server-side request forgery (SSRF). The exploit can be carried out remotely, and details of the attack have been made public, posing a significant risk to users who have not patched their systems.

Vulnerability Details

The vulnerability lies in the previewAction function within the Tool.php file. The function is not correctly validating and sanitizing the input data, allowing attackers to manipulate the data argument and send unauthorized requests to internal or external resources.

Here's a code snippet showcasing the vulnerability

public function previewAction(){
    $html=input('html','','trim');
    if(empty($html)){
        $data=input('data/a','','trim');
        $data['url']=trim($data['url']);
        if(!empty($data['url'])){
            $curl = new \Curl();
            $html=$curl->get($data['url']);
        }
    }
    exit($html);
}

As seen in the code above, the issue stems from the lack of proper validation and sanitization of the $data variable, which contains the URL input by the user. When manipulated, this can lead to SSRF and compromise the system’s security.

Exploit Details

The exploit can be launched remotely by an attacker, who can manipulate the $data argument to initiate unauthorized requests through the vulnerable application. This could potentially lead to sensitive information disclosure or further attacks on internal systems.

Technical details and a proof-of-concept for the exploit can be found in the following references

1. CVE-2025-1799 Details and Exploit
2. Zorlan SkyCaiji 2.9 Vulnerability Analysis

To protect your system against this vulnerability, it's essential to take the following steps

1. Update your Zorlan SkyCaiji software to the latest version, which addresses the vulnerability. Ensure you regularly check for and install updates to the software.
2. Implement proper input validation and sanitization in your codebase to prevent such vulnerabilities from being exploited in the future. This can help reduce the risk of SSRF and other attacks.
3. Regularly test and scan your applications for vulnerabilities, and stay on top of the latest security threats by following reputable security blogs and websites.

Conclusion

The critical CVE-2025-1799 vulnerability found in Zorlan SkyCaiji 2.9 poses a significant risk to users who have not updated their software and implemented the necessary precautions. By following the mitigation steps outlined above, users can help protect their systems from this vulnerability and maintain a secure environment. As always, vigilance and proper coding practices are crucial in keeping your applications and systems safe from potential threats.

Timeline

Published on: 03/01/2025 18:15:34 UTC
Last modified on: 03/03/2025 21:15:16 UTC