CVE-2025-14518: 
Java vulnerability analysis and mitigation

CVE-2025-14518 is a Server-Side Request Forgery (SSRF) vulnerability in PowerJob, an open-source distributed job scheduling framework. It affects the checkConnectivity function in src/main/java/tech/powerjob/common/utils/net/PingPongUtils.java within the Network Request Handler component, impacting all versions up to and including 5.1.2. The vulnerability was disclosed on November 28, 2025 (via GitHub issue) and published to the NVD and GitHub Advisory Database on December 11, 2025. CVSS v3.1 base score is 9.8 (Critical) per VulDB's assessment, while the GitHub Advisory Database rates it Moderate (CVSS v4.0: 5.3) (Github Advisory, PowerJob Issue).

The root cause is CWE-918 (Server-Side Request Forgery): the /server/checkConnectivity HTTP GET endpoint in ServerController.java passes user-supplied targetIp and targetPort parameters directly to PingPongUtils.checkConnectivity(), which opens a raw TCP socket (new Socket(targetIp, targetPort)) without any validation or allowlist enforcement. This allows an attacker to direct the server to initiate arbitrary TCP connections to any IP and port, including internal network resources not otherwise accessible. A public proof-of-concept Python script has been published demonstrating exploitation via DNS out-of-band (OOB) callbacks, confirming the server initiates outbound connections to attacker-controlled hosts (PowerJob Issue, Github Advisory).

Successful exploitation allows an attacker to use the PowerJob server as a proxy to probe and interact with internal network services that are otherwise firewalled from external access, enabling internal port scanning, service enumeration, and potential access to sensitive internal APIs (e.g., cloud metadata endpoints, databases, or administrative interfaces). This can facilitate lateral movement within the network and data exfiltration. The CVSS v3.1 score of 9.8 reflects high confidentiality, integrity, and availability impacts in the most severe exploitation scenarios (Github Advisory, PowerJob Issue).

1. Reconnaissance: Identify internet-facing PowerJob server instances (versions ≤ 5.1.2) using tools like Shodan or Censys, searching for the PowerJob web interface (default port 7700).
2. Identify the vulnerable endpoint: Locate the unauthenticated (or low-privilege) HTTP GET endpoint at /server/checkConnectivity.
3. Craft the SSRF request: Send a GET request with attacker-controlled targetIp and targetPort parameters, e.g.:

   GET /server/checkConnectivity?targetIp=169.254.169.254&targetPort=80 HTTP/1.1
   Host: <powerjob-server>

4. Probe internal services: Iterate over internal IP ranges and ports to enumerate accessible services (e.g., cloud metadata at 169.254.169.254, internal databases, admin panels).
5. OOB confirmation: Use a DNS/HTTP OOB callback service (e.g., Burp Collaborator, interactsh) as the targetIp to confirm outbound connections from the server, as demonstrated in the public PoC.
6. Exploit discovered services: Use the SSRF to interact with discovered internal services, potentially extracting credentials, tokens, or sensitive data (PowerJob Issue).

• Network: Unexpected outbound TCP connections from the PowerJob server to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); outbound connections to external OOB callback domains from the PowerJob process.
• Logs: Web/application access logs showing repeated GET requests to /server/checkConnectivity with varying targetIp and targetPort parameters, especially to internal addresses or unusual external hosts.
• Process: The PowerJob Java process initiating unexpected outbound socket connections to non-PowerJob worker nodes or external hosts.

As of the advisory publication date, no patched version beyond 5.1.2 has been officially released (the GitHub Advisory lists "Patched versions: None") (Github Advisory). Organizations should monitor the PowerJob repository for a patch release and upgrade immediately when available. In the interim, implement network-level egress filtering to restrict outbound connections from PowerJob servers to only known worker nodes; apply firewall rules blocking access to internal network ranges and cloud metadata endpoints from the PowerJob server; and restrict access to the /server/checkConnectivity endpoint to trusted IP addresses only via a reverse proxy or WAF.

The vulnerability was reported by researcher "NinjaGPT" via a GitHub issue on November 28, 2025, and subsequently assigned a CVE and published to the GitHub Advisory Database on December 11, 2025 (PowerJob Issue, Github Advisory). No significant broader media coverage or notable public researcher commentary beyond the original disclosure has been identified at this time.