CVE-2025-2245

A server-side request forgery (SSRF) vulnerability exists in the Bitdefender GravityZone Update Server when operating in Relay Mode. The HTTP proxy component on port 7074 uses a domain allowlist to restrict outbound requests, but fails to properly sanitize hostnames containing null-byte (%00) sequences. By crafting a request to a domain such as evil.com%00.bitdefender.com, an attacker can bypass the allowlist check, causing the proxy to forward requests to arbitrary external or internal systems.

Score

CVSS 4.0 6.9 Medium

Status

Analyzed - cve-requests@bitdefender.com

Published

2025-04-04

Last modified

2025-04-04

Weaknesses

CWE-918

Affected products

• Gravityzone Update Server (Bitdefender)

References

• https://www.bitdefender.com/support/security-advisories/server-side-request-forgery-in-gravityzone-update-server-using-…