CVE-2025-34282

MEDIUM

ThingsBoard < v4.2.1 SVG Image SSRF

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-34282 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

ThingsBoard versions < 4.2.1 contain a server-side request forgery (SSRF) vulnerability in the dashboard's Image Upload Gallery feature. An attacker can upload a malicious SVG file that references a remote URL. If the server processes the SVG file in a way that parses external references, it may initiate unintended outbound requests. This can be used to access internal services or resources.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 17, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

ThingsBoard

Browse ThingsBoard, Inc. / ThingsBoard

Default status: unaffected

CVE ListBefore 4.2.1affected

Proofs of concept

2

Catalogued exploits

ExploitDBThingsBoard IoT Platform 4.2.0 - Server-Side Request Forgery (SSRF)ExploitDB exploitby 9tamilmathiExploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that automates a two-step SSRF exploit against ThingsBoard IoT Platform 4.2.0. It uploads a crafted SVG file containing an external URL reference to the Image Upload Gallery API, then creates a dashboard widget embedding the uploaded SVG's public link to trigger a server-side request to the attacker-specified internal URL.

Backdoor review

No backdoor observed in reviewed code

The PoC script is a straightforward SSRF exploit against ThingsBoard. It uploads a user-supplied SVG file and creates a widget embedding the returned public link. All network requests target the configured ThingsBoard instance (localhost:8080 by default) using the provided bearer token. No hidden or unrelated outbound connections, persistence mechanisms, credential exfiltration, or deceptive payloads are present.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareThingsBoard IoT Platform
Attack typesServer-Side Request Forgery (SSRF)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively performs the steps required to exploit the SSRF vulnerability: it uploads a malicious SVG and creates a widget that causes the server to issue a request to an attacker-controlled internal URL. This goes beyond detection or scanning; it exercises the vulnerability to achieve the SSRF effect.

exploits/multiple/webapps/52551.py:24-28exploits/multiple/webapps/52551.py:142-161

Requirements

  • Requires a valid Tenant Admin bearer token for the target ThingsBoard instance.exploits/multiple/webapps/52551.py:20-22
  • Requires a crafted SVG file containing a remote URL reference (e.g., http://127.0.0.1:5555) to be uploaded.exploits/multiple/webapps/52551.py:15-18
  • Target ThingsBoard instance must be running and accessible at the default localhost URLs (configurable in code).exploits/multiple/webapps/52551.py:57-60

Observed behavior

  • Uploads a user-supplied SVG file to the /api/image endpoint using a multipart POST request with the provided bearer token.exploits/multiple/webapps/52551.py:62-91
  • Extracts the publicLink from the upload response and uses it to construct a widget payload containing an <object> tag that references the uploaded SVG.exploits/multiple/webapps/52551.py:102-108
  • Creates a new widget type via POST /api/widgetType, embedding the SVG public link, which when rendered by the server triggers a fetch of the external URL referenced in the SVG.exploits/multiple/webapps/52551.py:93-140
  • Prints success messages instructing the user to add the created widget to a dashboard to trigger the SSRF.exploits/multiple/webapps/52551.py:159-161
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Target
Payload withheldThe script hardcodes the target ThingsBoard server. All API calls (image upload, widget creation) are directed to this host.exploits/multiple/webapps/52551.py:57-60
Credential Usage
Payload withheldThe token is used only in the X-Authorization header for the intended API calls. It is not exfiltrated or sent to any third party.exploits/multiple/webapps/52551.py:79exploits/multiple/webapps/52551.py:95exploits/multiple/webapps/52551.py:170
File Upload
Payload withheldThe script reads a local SVG file and uploads it to the target server. The file content is not modified or inspected by the script; the SSRF is triggered server-side when the SVG is processed.exploits/multiple/webapps/52551.py:62-91
Review boundaries

What the analysis did not establish

  • The evidence consists solely of the Python script; no SVG payload file is included, so the exact content of the malicious SVG is only described in comments.
  • The script hardcodes default target URLs to localhost:8080; it does not accept a target host argument, limiting flexibility without code modification.
  • No network traffic or server responses are captured to confirm successful exploitation; classification is based on code intent and described behavior.
  • The review covers only the supplied exploit script. External dependencies (the 'requests' library) and the referenced SVG payload file are not included in the evidence and were not analyzed.
  • The script's behavior depends on the content of the user-supplied SVG file; a malicious SVG could contain additional payloads, but that is outside the scope of this script review.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubmathitam/thingsboard-ssrf-cve-2025-34282Repository PoCby mathitam0Exploit3 files

13.2 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script that automates a two-step SSRF exploit against ThingsBoard < 4.2.1 by uploading a crafted SVG file and creating a widget that triggers a server-side request to an attacker-controlled URL.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2025-34282. The script performs only the documented SSRF exploit steps: uploading an SVG file and creating a widget that references the uploaded file. No concealed executable behavior, persistence, credential theft, unrelated remote access, or other backdoor payloads were observed.

ClassificationExploit
Model confidence95%
AuthenticationRequired
Languagespython
Target softwareThingsBoard
Attack typesserver-side request forgery (ssrf)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script actively performs the attack steps (uploading a malicious SVG and creating a widget) to cause the server to make an unintended outbound request, which is the definition of an exploit. It does not merely detect or report the vulnerability.

thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:1-3thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:142-161

Requirements

  • Tenant Admin bearer token for the target ThingsBoard instancethingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:20-22
  • A crafted SVG file containing an internal URL reference (e.g., payload withheld)README.md:30-31
  • Network listener on the attacker's machine to receive the SSRF callbackREADME.md:52-55

Observed behavior

  • Uploads a user-supplied SVG file to the ThingsBoard /api/image endpoint using a Bearer tokenthingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:62-91
  • Extracts the publicLink of the uploaded image from the API responsethingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:147-151
  • Creates a custom widget via /api/widgetType that embeds the SVG's publicLink inside an <object> tag, causing the server to fetch the SVG and trigger the SSRFthingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:93-108thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:135-137
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Endpoint
Payload withheldTarget endpoint for the SSRF exploit's SVG upload step.thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:57
Network Endpoint
Payload withheldTarget endpoint for the SSRF exploit's widget creation step.thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:58
Network Endpoint
Payload withheldInternal URL embedded in the SVG payload to demonstrate SSRF.README.md:30thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py:37
Review boundaries

What the analysis did not establish

  • The actual SVG payload file (ssrf_localhost_5555.svg) is not included in the selected text evidence; only its description and a snippet are present in README.md and the Python script comments.
  • The evidence does not include the server response or any captured network traffic confirming successful SSRF execution.
  • One file (543 bytes) was classified as unclassified and was not inspected; its content is unknown.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

4