Server Side Request Forgery in Ziti Console

The SSRF vulnerability in Ziti Console allows an attacker to craft a malicious URL parameter that triggers the console to make requests to unintended destinations. This can lead to unauthorized access to internal services, data exfiltration, and potentially even remote code execution if the targeted internal service is vulnerable. An attacker could leverage this to scan internal networks, access sensitive configuration files, or interact with other internal applications without proper authentication. The potential blast radius extends to any internal resource accessible via HTTP or HTTPS from the Ziti Console server.

Organizations utilizing Ziti Console for zero-trust network access, particularly those with internal services accessible via HTTP or HTTPS, are at risk. Shared hosting environments where multiple users share a Ziti Console instance are also particularly vulnerable, as an attacker could potentially exploit the vulnerability to access resources belonging to other users.

• generic web: Use curl to check for the vulnerable endpoint and test for SSRF behavior by providing a URL pointing to an internal resource.

curl 'https://<ziti-console-ip>/admin/endpoint?url=http://internal-service/'

• linux / server: Monitor access logs for requests to the /admin/endpoint endpoint with unusual or internal URLs. Use grep to search for patterns indicative of SSRF attempts.

grep 'http://internal-' /var/log/nginx/access.log

1. 2025-03-03Disclosure

   disclosure

1. Reserviert2025-02-26
2. Veröffentlicht2025-03-03
3. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-27501 is to upgrade Ziti Console to version 3.7.1 or later. This version moves the request handling from the server-side to the client-side, effectively eliminating the SSRF vulnerability. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) with rules to block requests containing suspicious URL parameters. Thoroughly review and restrict network access to the Ziti Console server to limit the potential impact of a successful SSRF attack. After upgrade, confirm the fix by attempting to trigger the vulnerable endpoint with a crafted URL and verifying that the request is properly handled by the client.