CVE-2025-14518: Server-Side Request Forgery Vulnerability in PowerJob's PingPongUtils
Summary
CVE-2025-14518: PowerJob has a server-side request forgery vulnerability in PingPongUtils.java. Affects tech.powerjob:powerjob-common versions < 5.1.2. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
PowerJob is an open-source job scheduling framework designed for distributed systems. It provides a robust platform for managing and executing background tasks efficiently. The framework's architecture allows for seamless integration with various services, making it a popular choice for developers. However, versions up to 5.1.2 contain a critical vulnerability in its Network Request Handler component, specifically in the PingPongUtils.java file, which can be exploited to perform server-side request forgery (SSRF) attacks.
Vulnerability Detail
The vulnerability arises from improper handling of user-supplied input in the checkConnectivity function of PingPongUtils.java. By manipulating the targetIp and targetPort arguments, an attacker can craft requests that the server processes, potentially leading to unauthorized access to internal services or data. This vulnerability is particularly concerning as it allows remote exploitation, meaning attackers can execute SSRF attacks from outside the network, posing significant security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, consider implementing network-level restrictions to limit access to sensitive internal services. Additionally, validate and sanitize all inputs to the checkConnectivity function to prevent SSRF attacks.
Conclusion
The CVE-2025-14518 vulnerability in PowerJob's PingPongUtils presents a significant security risk due to its potential for SSRF attacks. It is crucial for users of affected versions to update to the patched version 5.1.3 or later to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for tech.powerjob:powerjob-common →
FAQ
SSRF is a web security vulnerability that allows an attacker to send crafted requests from the server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Simply upload your pom.xml file at Vulert Scanner to assess your application's vulnerability status.
Exploitation of this vulnerability can lead to unauthorized access to internal services, data leakage, and potentially compromise the entire application or network.
Yes, a patch is available in version 5.1.3 of the powerjob-common package. It is recommended to upgrade to this version or later.
If an immediate update is not possible, implement input validation and network restrictions as a temporary workaround to mitigate the risk of SSRF attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for tech.powerjob:powerjob-common.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
