CVE-2025-11529

Executive Summary

CVE-2025-11529 is a critical missing authentication vulnerability in ChurchCRM, an open-source church management application. The flaw resides in the AuthMiddleware component, specifically within the file src/ChurchCRM/Slim/Middleware/AuthMiddleware.php. This vulnerability allows an unauthenticated remote attacker to bypass authentication checks for API endpoints, potentially gaining unauthorized access to sensitive data and administrative functions. The vulnerability affects all versions up to and including 5.18.0. A public exploit has been released, and a patch is available. The CVSS score is 7.3 (High), and the EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the public availability of the exploit increases the risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code vulnerability in the ChurchCRM application. The application is typically deployed as a PHP web application. The supply chain risk is low, but organizations using ChurchCRM should prioritize patching.

CVSS Breakdown & Threat Level

• CVSS Score: 7.3 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) - The attacker does not need to trick a user into performing any action.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) - Successful exploitation can lead to complete disclosure of all resources.
• Integrity (I): High (H) - Successful exploitation can allow the attacker to modify or delete data.
• Availability (A): None (N) - The vulnerability does not directly impact system availability.

Threat Level: High. The combination of remote exploitability, no required privileges, and the potential for complete data compromise makes this a critical threat. The public availability of exploit code further elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic case of missing authentication (CWE-306). The AuthMiddleware class is designed to check if a user is authenticated before allowing access to certain API endpoints. However, due to a logic flaw, the middleware fails to properly enforce authentication for all API routes.

The core issue lies in the AuthMiddleware class. The middleware likely checks for the presence of a valid session or API key. However, the flaw allows requests to bypass this check, possibly due to:

• Incorrect route matching: The middleware might not be applied to all intended API endpoints.
• Improper handling of authentication headers: The middleware might not correctly parse or validate authentication tokens.
• Logic error in the __invoke method: The middleware might return early or skip the authentication check under certain conditions.

The public exploit likely sends a crafted HTTP request to a specific API endpoint without any authentication credentials. The server, due to the flawed middleware, processes the request and returns sensitive data or performs privileged actions.

Vulnerable vs. Patched Code

The patch commit 3a1cffd2aea63d884025949cfbcfd274d06216a4 addresses the vulnerability. While the exact code changes are not provided in the CVE data, the patch likely modifies the AuthMiddleware.php file to ensure that authentication is properly enforced for all API endpoints.

Vulnerable Code (Conceptual):

// src/ChurchCRM/Slim/Middleware/AuthMiddleware.php (Vulnerable)
class AuthMiddleware {
    public function __invoke($request, $response, $next) {
        // Flawed logic: might skip authentication for certain routes
        if ($this->shouldSkipAuth($request)) {
            return $next($request, $response);
        }
        // ... authentication check ...
    }
}

Patched Code (Conceptual):

// src/ChurchCRM/Slim/Middleware/AuthMiddleware.php (Patched)
class AuthMiddleware {
    public function __invoke($request, $response, $next) {
        // Always enforce authentication
        if (!$this->isAuthenticated($request)) {
            return $response->withStatus(401);
        }
        return $next($request, $response);
    }
}

The key difference is that the patched version removes any logic that could bypass the authentication check, ensuring that all requests to protected endpoints are authenticated.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable instance of ChurchCRM (version <= 5.18.0).
• Network access to the target server.

Exploitation Steps:

1. Identify the Target: Scan for ChurchCRM instances using Shodan dorks or other reconnaissance methods.
2. Craft the Exploit: The public exploit likely involves sending a GET or POST request to a specific API endpoint without authentication headers. For example:

   curl -X GET "http://target-churchcrm/api/people" -H "Content-Type: application/json"
   

   This request should normally require authentication, but due to the vulnerability, it will return a list of people.
3. Extract Data: The response will contain sensitive data, such as member information, financial records, or administrative details.
4. Escalate Privileges: If the API allows administrative actions, the attacker can create new users, modify settings, or delete data.

Lab Setup:

• Use Docker to set up a vulnerable ChurchCRM instance:

  docker run -d -p 8080:80 --name churchcrm-vuln churchcrm/churchcrm:5.18.0
  

• Access the instance at http://localhost:8080.
• Use the curl command above to test the vulnerability.

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP requests to API endpoints without valid authentication tokens.
• Look for unusual patterns in API access logs, such as requests from unknown IP addresses or user agents.
• Use the detection rules provided in the Detection Engineering section.

Response:

1. Immediately apply the patch (commit 3a1cffd2aea63d884025949cfbcfd274d06216a4) or upgrade to a patched version.
2. Review API access logs for any unauthorized access attempts.
3. Rotate all API keys and passwords if compromise is suspected.
4. Conduct a forensic analysis to determine the extent of the breach.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/* endpoints without Authorization headers.
  • Requests from IP addresses not in the allowed list.
  • Unusual user-agent strings (e.g., curl/7.68.0, python-requests/2.25.1).
• File IOCs:
  • Modified or new files in the src/ChurchCRM/Slim/Middleware/ directory.
  • Unauthorized changes to the database.
• Log IOCs:
  • Repeated 401 or 403 errors followed by successful 200 responses to API endpoints.
  • Log entries showing access to sensitive API endpoints from unexpected sources.

Detection Engineering

YARA Rule

rule CVE_2025_11529_AuthMiddleware {
    meta:
        description = "Detects vulnerable AuthMiddleware.php in ChurchCRM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11529"
    strings:
        $vuln_func = "shouldSkipAuth" nocase
        $vuln_class = "class AuthMiddleware" nocase
    condition:
        $vuln_class and $vuln_func
}

Sigma Rule

title: CVE-2025-11529 - ChurchCRM Missing Authentication
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit missing authentication in ChurchCRM API endpoints.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11529
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/'
        sc-status: 200
    filter:
        cs-uri-stem: '/api/login'
    condition: selection and not filter
falsepositives:
    - Legitimate API calls with valid authentication
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-11529 - ChurchCRM Missing Authentication"; flow:to_server,established; content:"GET"; http_method; content:"/api/"; http_uri; pcre:"/^\/api\/(?!login)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Update ChurchCRM to a version that includes the fix (commit 3a1cffd2aea63d884025949cfbcfd274d06216a4). If using a package manager, check for updates.
2. Restrict Network Access: Use a firewall or web application firewall (WAF) to block access to API endpoints from untrusted networks.
3. Enable Logging: Ensure detailed logging of all API requests is enabled and monitored.

Long-Term Mitigations:

1. Implement Strong Authentication: Use multi-factor authentication (MFA) for all administrative accounts.
2. Regular Security Audits: Conduct regular code reviews and penetration testing.
3. Stay Updated: Subscribe to security advisories for ChurchCRM and other software in use.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@valters-it.com.