Notifications
Clear all
Topic starter
11/08/2026 3:23 pm
TL;DR: Knowledge of older SSRF patterns helped surface CVE-2025-27888 in Apache Druid’s management proxy, where URL parsing confusion enabled server-side request forgery before versions 31.0.2 and 32.0.1, according to Xbow. The finding reinforces that proxy-style attack surfaces need stricter input handling, internal request controls, and rapid patching, especially where management functions can reach internal resources.
NHIMG editorial — based on content published by Xbow: CVE-2025-27888, server-side request forgery via URL parsing confusion in Apache Druid proxy endpoint
By the numbers:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: How should security teams reduce SSRF risk in management proxies?
A: Start by restricting where the proxy can send requests, then validate that every URL is canonicalised before use.
Q: Why do proxy-style application features create high-risk trust boundaries?
A: Because the application becomes an intermediary that can speak to internal resources the attacker cannot reach directly.
Q: What do teams get wrong about SSRF defenses?
A: They often stop at URL parsing and blocklists.
Practitioner guidance
- Harden all proxy endpoints with strict allowlists Limit outbound destinations to explicit host and scheme allowlists, reject ambiguous URLs after canonicalisation, and block internal ranges, metadata IPs, and localhost targets.
- Separate administrative fetch paths from user traffic Move management proxies behind dedicated authentication, network segmentation, and role-based access controls so they are not reachable through ordinary application interfaces.
- Test extensions and plugins for internal reachability Review custom plugins, console extensions, and administrative features for any ability to initiate internal requests, then add SSRF test cases to release validation.
What's in the full report
Xbow's full research covers the exploit trace and remediation detail this post intentionally leaves for the source:
- Step-by-step trace of how the management proxy was probed and how the final SSRF path was reached.
- The specific behaviour of the Apache Druid proxy endpoint before versions 31.0.2 and 32.0.1.
- The full advisory context and patch guidance needed for implementation teams.
- The intermediate failed hypotheses that show how older CVE patterns shaped the search process.
👉 Read Xbow's analysis of CVE-2025-27888 in Apache Druid →
URL parsing confusion in Apache Druid proxy endpoints: what teams need to know?
Explore further
11/08/2026 3:33 pm
URL parsing confusion is a control failure, not just a coding defect. When the same URL is interpreted differently across validation, routing, and outbound fetch logic, the application effectively creates two trust models at once. That mismatch is what makes SSRF durable across product generations. For practitioners, the lesson is to treat canonicalisation and destination allowlisting as governance controls, not optional hardening.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should organisations respond when an internal fetch path is exposed?
A: Treat it as a privileged access issue. Disable or restrict the path immediately, review whether it can reach metadata services or admin APIs, and add monitoring for unusual internal destinations. Then patch the parsing flaw and retest any extensions or plugins that may expose the same pattern.
👉 Read our full editorial: Apache Druid proxy SSRF shows how URL parsing confusion breaks defenses
