Halo CMS CVE-2025-60898
MEDIUMSeverity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Unauthenticated network endpoint (PR:N, AV:N), no complexity barrier (AC:L), scope changes as internal systems are reachable (S:C), limited confidentiality via URL/header leakage only (C:L), no integrity or availability impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Lifecycle Timeline
1DescriptionCVE.org
An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP requests to attacker-controlled URLs, including internal addresses. The endpoint performs a server-side GET to a user-supplied URI without adequate allow/blocklist validation and returns a 307 redirect that can disclose internal URLs in the Location header.
AnalysisAI
Unauthenticated SSRF in Halo CMS 2.21 exposes internal network infrastructure to remote attackers via the Thumbnail via-uri endpoint, which performs server-side HTTP GET requests to attacker-supplied URLs without allowlist or blocklist enforcement. Beyond initiating outbound connections to attacker-controlled hosts, the endpoint issues a 307 redirect that leaks internal URLs in the Location header, enabling internal network reconnaissance. EPSS is low (0.27%, 19th percentile) with no CISA KEV listing, but a public researcher disclosure document exists, lowering the barrier to exploitation.
Technical ContextAI
Halo CMS is a Java-based open-source content management and blogging platform. The vulnerable component is a thumbnail-fetching endpoint that accepts a user-supplied URI parameter and performs a server-side HTTP GET to that URI - a classic CWE-918 (Server-Side Request Forgery) pattern. The lack of an effective allowlist or blocklist means the server can be directed to reach RFC 1918 internal addresses, cloud metadata endpoints (e.g., 169.254.169.254), or attacker infrastructure. The CVSS vector includes S:C (scope change), indicating the vulnerable component can cause impact beyond its own security scope - specifically, it can probe and interact with internal systems not otherwise accessible to the attacker. The 307 redirect behavior is an additional information-disclosure vector: even if the server cannot fully relay response bodies, the Location header in the redirect response discloses the internal URL structure.
Affected ProductsAI
Halo CMS version 2.21 is explicitly identified as affected per the researcher's disclosure at https://github.com/abdulr7mann/CVEs/blob/main/CVE-2025-60898/CVE-2025-60898.md. No CPE strings were provided in the available intelligence, and no official vendor advisory has been identified. Whether earlier or later versions of Halo CMS share the same vulnerable Thumbnail via-uri endpoint behavior is not confirmed from available data.
RemediationAI
No vendor-released patch has been identified at time of analysis - the sole reference is a third-party researcher disclosure, not an official Halo CMS security advisory. Operators should check the Halo CMS project repository and official channels for a patched release. As compensating controls: restrict external network egress from the Halo CMS application server to only necessary destinations, which prevents the server from reaching internal RFC 1918 addresses or cloud metadata endpoints (trade-off: may break legitimate thumbnail fetching from allowed CDNs). Implement a strict URI allowlist in the thumbnail endpoint that permits only trusted external domains and explicitly denies loopback, link-local (169.254.0.0/16), and private IP ranges. If the Thumbnail via-uri feature is non-essential, disabling or removing the endpoint entirely eliminates the attack surface with no functional trade-off for sites not relying on it. Monitor application logs for unexpected outbound HTTP connections originating from the CMS process.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today