CVE-2025-2245: Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)
A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-2245?
CVE-2025-2245 has been rated as a high severity vulnerability due to its potential exploitation via server-side request forgery.
How do I fix CVE-2025-2245?
To fix CVE-2025-2245, it is recommended to update the Bitdefender GravityZone Update Server to the latest version provided by the vendor.
Which software is affected by CVE-2025-2245?
CVE-2025-2245 affects the Bitdefender GravityZone Update Server when it is operating in Relay Mode.
What kind of vulnerability is CVE-2025-2245?
CVE-2025-2245 is a server-side request forgery (SSRF) vulnerability.
What can an attacker achieve by exploiting CVE-2025-2245?
An attacker exploiting CVE-2025-2245 could make unauthorized outbound requests from the affected server, potentially accessing sensitive resources.