PowerJob CVE-2025-14518

Authentication is required - only users with valid PowerJob credentials (PR:L in CVSS vector) can access the checkConnectivity function. The vulnerable code path is triggered specifically when the checkConnectivity function is invoked with attacker-controlled targetIp and targetPort parameters, requiring knowledge of the endpoint's existence and HTTP method. No indication in the description suggests that special configuration, non-default feature enablement, or specific deployment modes are required beyond basic authentication. However, exploitation impact is substantially limited if the network architecture implements proper egress filtering, internal firewall rules, or service mesh policies that restrict the PowerJob application's outbound connections to legitimate destinations only.

Despite the availability of public exploit code, this vulnerability presents minimal real-world risk based on multiple conflicting signals. The CVSS 4.0 vector shows network-accessible attack surface (AV:N) with low complexity (AC:L) but requires authenticated access (PR:L), limiting the threat model to internal users or those with valid credentials. The EPSS score of 0.03% in the 7th percentile is exceptionally low, indicating very few organizations are likely to be compromised, despite public awareness of the vulnerability. The limited confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L with no scope change) means successful exploitation does not grant system-level compromise or widespread data exfiltration. The most probable explanation for the gap between 'publicly available exploit' and 'minimal real-world exploitation' is that this SSRF requires authenticated access, application-specific internal knowledge of vulnerable endpoints, and post-exploitation pivoting skills-factors that substantially reduce real-world threat likelihood compared to unauthenticated RCE vulnerabilities. However, organizations using PowerJob in zero-trust internal networks where user compromise is realistic should still prioritize patching due to SSRF's chaining potential.

An authenticated PowerJob user with access to job scheduling or monitoring features discovers the checkConnectivity endpoint and supplies a crafted targetIp parameter pointing to an internal AWS metadata service endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/) and an arbitrary targetPort. The PowerJob server processes this request and returns the response containing AWS credentials or internal service tokens, which the attacker exfiltrates. Alternatively, the attacker targets an internal database service on port 5432 or a Kubernetes API endpoint on port 6443, using SSRF to bypass network segmentation controls and directly interact with systems not intended to be accessible from the application tier.