Loading vulnerability…
SSRF in Apryse WebViewer server-side iFrame rendering
CVE-2025-70400 is described as a high-severity server-side request forgery (SSRF) vulnerability in Apryse WebViewer’s server-side iFrame rendering component. The issue allows attacker-controlled content/URLs to be fetched and rendered by the server-side rendering functionality, indicating insufficient validation of untrusted, remotely supplied rendering inputs crossing a trust boundary between the client-controlled configuration/content and the server-side renderer.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an attacker to induce the WebViewer server-side rendering service to make outbound requests to attacker-chosen targets. This can expose internal network reachability and enable access to internal-only resources and metadata (e.g., cloud instance metadata services), potentially facilitating further compromise depending on what internal endpoints are reachable and how responses are handled/rendered.
If you can’t patch tonight, do this now.
Until patched, restrict the server-side rendering component’s egress (network-level allowlist) to only required destinations; block access to RFC1918/ULA ranges and cloud metadata IPs (e.g., 169.254.169.254) from the rendering service; and isolate the rendering service in a segmented network with minimal privileges to reduce SSRF blast radius.
Patch, then assume compromise.
Apply Apryse-provided patches/updates that address CVE-2025-70400 in the server-side iFrame rendering component. Ensure the server-side renderer enforces strict allowlisting/denylisting and URL validation for any remotely supplied resources it fetches as part of rendering, per vendor guidance.
No public exploits tracked yet. Mallory keeps watching.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.