CVE-2025-25069 Apache Kvrocks: Cross-Protocol Scripting Vulnerability

Medium 6.5 Published 7 Feb 2025 Updated 13 Feb 2025

Attackers can send HTTP requests to Kvrocks via RESP protocol, potentially enabling SSRF attacks and unauthorized database operations.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2025-25069?

CVE-2025-25069 is a medium-severity server-side request forgery vulnerability in Apache Kvrocks, published on 7 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks.

Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP request can also be sent to Kvrocks as a valid RESP request and trigger some database operations, which can be dangerous when it is chained with SSRF.

It is similiar to CVE-2016-10517 in Redis.

This issue affects Apache Kvrocks: from the initial version to the latest version 2.11.0.

Users are recommended to upgrade to version 2.11.1, which fixes the issue.

Weakness: CWE-115

Which versions are affected by CVE-2025-25069?

It affects 1 product.

Products include Apache Kvrocks.

How do I fix CVE-2025-25069?

No fix has been published for CVE-2025-25069 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2025-25069 being exploited?

There is no known exploitation of CVE-2025-25069 in the wild and no public exploit code.

Sources

Also known as GHSA-fp9p-7hx8-xfp3.