Overview
CVE-2025-13796 identifies a Server-Side Request Forgery (SSRF) vulnerability present in deco-cx applications up to version 0.120.1. This flaw allows a remote attacker to potentially force the application to make requests to unintended locations, potentially exposing sensitive internal resources or performing actions on behalf of the server. Upgrading to version 0.120.2 is strongly recommended to address this security issue.
Technical Details
The vulnerability resides within the AnalyticsScript function found in the website/loaders/analyticsScript.ts file of the deco-cx apps. Specifically, the component affected is the Parameter Handler. By manipulating the url argument, an attacker can inject arbitrary URLs, causing the server to make requests to those URLs. This allows for SSRF exploitation.
The publicly disclosed exploit makes this vulnerability particularly concerning as attackers may leverage existing resources to exploit vulnerable systems.
CVSS Analysis
This vulnerability has been assigned a CVSS score of 6.3, indicating a MEDIUM severity.
- CVSS Score: 6.3
- Vector String: (Vector string not available in provided data, but typically includes AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Possible Impact
Successful exploitation of CVE-2025-13796 can have several serious consequences:
- Internal Resource Access: An attacker could access internal services or resources that are not directly exposed to the internet.
- Data Exfiltration: The attacker might be able to exfiltrate sensitive data from internal systems.
- Denial of Service: In some scenarios, an attacker might be able to overload internal resources, leading to a denial-of-service condition.
- Potential for Further Exploitation: SSRF can be a stepping stone for more advanced attacks, such as Remote Code Execution (RCE) if internal systems are also vulnerable.
Mitigation and Patch Steps
The primary mitigation for CVE-2025-13796 is to upgrade your deco-cx apps installation to version 0.120.2 or later.
- Upgrade deco-cx apps: Immediately upgrade to version 0.120.2 using the official update mechanism.
- Verify the Upgrade: After upgrading, verify that the vulnerability is no longer present by testing the affected functionality.
