External risk intelligence

Illia Cloud illia-Builder SSRF Vulnerability Allows Internal Service Interaction.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2025-60279

The vulnerability affects an API within a cloud-building platform. APIs in these environments are commonly exposed as internet-facing services to facilitate remote development, automation, and integration, making them reachable in typical deployment patterns.

Server-Side Request Forgery

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical server-side request forgery vulnerability has been identified in Illia Cloud illia-Builder, impacting its API. This flaw enables authenticated users to direct arbitrary requests to internal services, potentially leading to the discovery of open ports and unauthorized interaction with sensitive internal systems.

Attackers can exploit internal cloud services.
Confirms need for regular API security checks.
Verify relevance and scope within our environment.

Attack Path

How an attacker could exploit the issue

An attacker who has already logged into the Illia Cloud platform can send specially crafted requests through the API. These requests can be directed to internal services within the platform's infrastructure, potentially exposing sensitive information or allowing interaction with other internal systems. This can lead to the discovery of open ports and further unauthorized access.

Authenticated access required to the platform.
Specially crafted API requests trigger the flaw.
Internal service interaction and port enumeration.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow authenticated users to send requests to internal services within the Illia Cloud environment. When supported by the advisory, this could expose sensitive internal system information through port enumeration based on response differences or allow interaction with internal services.

Internal network services.
Sending crafted API requests.
Unauthorized access to internal systems.

Operational Fix

Recommended remediation, mitigation, and detection steps

This SSRF vulnerability in Illia Cloud illia-Builder impacts organizations using the platform for cloud resource creation. Initial triage requires identifying all instances of illia-Builder, assessing their network exposure, confirming if they are business-critical, and locating the accountable system owner. Planning remediation should be risk-based, potentially involving coordination with the vendor and scheduling maintenance windows.

Application or platform owners should own the issue.
Verify affected illia-Builder instances and reachability.
Plan remediation based on risk and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Illia Cloud illia-Builder?

Illia Cloud illia-Builder is a cloud-building platform designed to streamline the creation and management of infrastructure resources. It provides API-driven services that developers and administrators use to automate deployments and manage cloud environments. The platform acts as a central hub for orchestration, often requiring integration with other internal cloud services to function effectively.

What does CVE-2025-60279 mean for this software?

CVE-2025-60279 refers to a Server-Side Request Forgery (SSRF) vulnerability. This means an attacker can force the application to make unintended requests to other services on the internal network. Essentially, the software can be tricked into acting as a proxy, allowing an attacker to reach internal components that are not typically accessible from the outside.

How does an attacker trigger this SSRF vulnerability?

To trigger the bug, an attacker must have authenticated access to the Illia Cloud platform. Once logged in, they send specifically crafted API requests that deviate from normal operational patterns to interact with internal targets. It is important to note that unauthorized or unauthenticated users cannot trigger this flaw; it requires valid access to the platform's API to initiate the malicious requests.

Is my instance at risk according to Halo Surface Signal?

Halo Surface Signal indicates that illia-Builder instances are often internet-facing to support remote development and integration, making them likely to be reachable by external actors. If your instance is exposed to the internet, it is at higher risk because the API acts as a gateway that attackers can reach directly to leverage this vulnerability.

What should I do if I run illia-Builder?

Your first step is to locate all active instances of illia-Builder within your infrastructure and confirm who is responsible for each. Check the version running to see if it is affected, and assess whether these instances need to be exposed to the internet. Coordinate with the platform owner to prioritize remediation based on your internal risk assessment and upcoming maintenance windows.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.