CVE-2025-34282
CRITICALThingsBoard < 4.2.1 - Server-Side Request Forgery via SVG Image Upload
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-34282. PoCs published by 9tamilmathi, mathitam.
AI-analyzed exploit summary This exploit demonstrates a Server-Side Request Forgery (SSRF) vulnerability in ThingsBoard IoT Platform versions before 4.2.1. It uploads a malicious SVG file containing a remote URL reference, which the server processes, allowing the attacker to reach internal services.
Description
ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.
Exploits (2)
This exploit demonstrates a Server-Side Request Forgery (SSRF) vulnerability in ThingsBoard IoT Platform versions before 4.2.1. It uploads a malicious SVG file containing a remote URL reference, which the server processes, allowing the attacker to reach internal services.
The repository contains a functional exploit for CVE-2025-34282, demonstrating an SSRF vulnerability in ThingsBoard IoT Platform versions before 4.2.1 via SVG image upload. The exploit includes a Python script that automates the upload of a malicious SVG file and the creation of a widget to trigger the SSRF.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N