CVE-2025-64709 - CVE House

Back to Database

Status published Critical CVE-2025-64709

Typebot May Expose AWS EKS Credentials via Server Side Request Forgery in Webhook Block

9.6 CVSS

Vulnerability Description

Typebot is an open-source chatbot builder. In versions prior to 3.13.1, a Server-Side Request Forgery (SSRF) vulnerability in the Typebot webhook block (HTTP Request component) functionality allows authenticated users to make arbitrary HTTP requests from the server, including access to AWS Instance Metadata Service (IMDS). By bypassing IMDSv2 protection through custom header injection, attackers can extract temporary AWS IAM credentials for the EKS node role, leading to complete compromise of the Kubernetes cluster and associated AWS infrastructure. Version 3.13.1 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64709

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://github.com/baptisteArno/typebot.io/security/advisories/GHSA-8gq9-rw7v-3jpr

More from baptisteArno

View All →

Typebot Vulnerable to Credential Theft via Client-Side Script Execution and API Authorization Bypass

Typebot IDOR Vulnerability: Unauthorized API Token Deletion and Exposure

typebot.io: `GHSL-2024-040`

Affected Vendor

baptisteArno

View all reports →

Affected Software

typebot.io

Vulnerable Versions:

< 3.13.1

Timeline

Official Publish: November 13th, 2025

Last Modified: November 13th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1213 Data from Information Repositories

T1005 Data from Local System

T1046 Network Service Discovery