Rocket TRUfusion Enterprise Pre-Auth SSRF Vulnerability (CVE-2025-32355)

From the screenshot, the following key information about the vulnerability can be obtained: Key Information Product: TRUfusion Enterprise Vendor URL: https://www.rocketsoftware.com/en-us/products/b2b-supply-chain-integration/trufusion CWE: Server-Side Request Forgery (SSRF) [CWE-918] Date found: 2025-02-12 Date published: 2026-02-16 CVSSv4 Score: 7.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H) CVE: CVE-2025-32355 Affected Versions TRUfusion Enterprise versions < 7.10.5 Vulnerability Details TRUfusion Enterprise contains a pre-authentication Server-Side Request Forgery (SSRF) vulnerability related to reverse proxy request handling. The proxy accepts absolute-form URLs provided by the attacker and forwards requests to arbitrary destinations, including internal network services not directly exposed. As a result, unauthenticated attackers can exploit the application as a relay to interact with internal endpoints and retrieve proxy responses, increasing the risk of internal service exposure and enabling follow-on attacks when chained with additional vulnerabilities. Solution Upgrade to TRUfusion Enterprise 7.10.5 Disclosure Timeline 2025-02-12: Vulnerability discovered 2025-04-04: Contacted vendor via established disclosure channel 2025-04-05: MITRE assigned CVE-2025-32355 2025-04-09: Vendor unable to reproduce, requested clarification 2025-04-09: Additional clarification provided 2025-04-28: Vendor unresponsive, requested update 2025-05-05: Vendor unresponsive, notified of expected disclosure date (2025-05-09) 2025-05-05: Vendor confirmed and committed to provide further information 2025-05-07: Disclosure date extended, allowing additional time 2025-05-22: Vendor unresponsive, requested update 2025-06-20: Vendor unresponsive, notified of revised expected disclosure date (2025-06-30) 2025-06-28: Disclosure date extended further based on goodwill 2025-07-07: Vendor unresponsive, requested update 2025-07-10: Vendor unresponsive, requested update 2025-07-14: Vendor unresponsive, disclosure delayed due to lack of vendor response 2025-08-25: Vendor unresponsive, requested update 2025-09-25: Vendor unresponsive, requested update 2025-11-12: Vendor unresponsive, requested update 2025-11-12: Vendor confirmed investigation is underway 2026-01-01: Happy New Year! 2026-02-09: Vendor unresponsive, requested update 2026-02-09: Vendor stated issue resolved 2026-02-09: Requested clarification on fixed version 2026-02-11: Vendor confirmed fix included in TRUfusion Enterprise 7.10.5 2026-02-16: Public disclosure

Goal Reached Thanks to every supporter — we hit 100%!

Rocket TRUfusion Enterprise Pre-Auth SSRF Vulnerability (CVE-2025-32355)