Vulnerability · Published Apr 4, 2025 · Assigned by Bitdefender
CVE-2025-2245Server Side Request Forgery in GravityZone Update Server Using Null Bytes (VA-12646)
Medium 6.9
In plain English
A medium-severity server-side request forgery in GravityZone Update Server from Bitdefender. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Official description
A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Bitdefender | GravityZone Update Server | 0 – before 3.5.2.689 |
Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L