CVE-2025-15005

Executive Summary

CVE-2025-15005 identifies a critical security flaw in CouchCMS versions up to 2.4. The vulnerability resides in the couch/config.example.php file, specifically within the reCAPTCHA Handler component. The issue involves the use of hard-coded cryptographic keys (K_RECAPTCHA_SITE_KEY and K_RECAPTCHA_SECRET_KEY), which are static and publicly known. This allows an attacker to bypass reCAPTCHA verification or decrypt sensitive data if the keys are reused in production. The attack is remotely exploitable but requires high complexity due to the need for specific knowledge of the application's configuration. The exploit has been publicly released, increasing the risk of targeted attacks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct issue within the CouchCMS application source code. The hard-coded keys are embedded in the distribution package, meaning any instance using the default configuration is at risk. No official patch or advisory has been released by the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 3.7 (Low)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: High (AC:H) – Requires knowledge of the hard-coded keys and specific application behavior.
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Potential exposure of reCAPTCHA keys or encrypted data.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. The high complexity and limited impact reduce immediate risk, but the public availability of the exploit and the lack of a patch elevate the need for proactive mitigation.

Deep Dive & Mechanics

The vulnerability is a classic case of CWE-321: Use of Hard-coded Cryptographic Key. In couch/config.example.php, the reCAPTCHA handler defines two constants:

define('K_RECAPTCHA_SITE_KEY', '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI');
define('K_RECAPTCHA_SECRET_KEY', '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe');

These keys are Google's test keys, publicly documented and intended only for development/testing. If a production site uses these keys without overriding them, an attacker can:

1. Bypass reCAPTCHA: Use the known secret key to validate fake reCAPTCHA responses.
2. Decrypt Data: If the keys are used for encryption (unlikely but possible), the attacker can decrypt any data encrypted with them.

The attack is remote and requires no authentication. The high complexity stems from the need to identify that the default keys are in use and to craft specific requests to exploit the reCAPTCHA bypass.

Vulnerable vs. Patched Code

Vulnerable Code (couch/config.example.php):

<?php
// ...
define('K_RECAPTCHA_SITE_KEY', '6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI');
define('K_RECAPTCHA_SECRET_KEY', '6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe');
// ...
?>

Patched Code (Recommended):

<?php
// ...
// Remove hard-coded keys and require environment variables or secure configuration
if (!defined('K_RECAPTCHA_SITE_KEY')) {
    define('K_RECAPTCHA_SITE_KEY', getenv('RECAPTCHA_SITE_KEY') ?: '');
}
if (!defined('K_RECAPTCHA_SECRET_KEY')) {
    define('K_RECAPTCHA_SECRET_KEY', getenv('RECAPTCHA_SECRET_KEY') ?: '');
}
// Validate that keys are not empty
if (empty(K_RECAPTCHA_SITE_KEY) || empty(K_RECAPTCHA_SECRET_KEY)) {
    throw new Exception('reCAPTCHA keys not configured');
}
// ...
?>

The patched version removes hard-coded values and instead reads from environment variables, failing securely if keys are missing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A CouchCMS instance using the default config.example.php without overriding the reCAPTCHA keys.
• Knowledge of the target's reCAPTCHA implementation.

Exploitation Steps:

1. Identify Target: Use Shodan dorks to find CouchCMS instances.
2. Verify Default Keys: Access couch/config.example.php (if exposed) or test reCAPTCHA responses with the known secret key.
3. Bypass reCAPTCHA: Send a POST request to the reCAPTCHA verification endpoint with the known secret key and a fake response token.

Example cURL Command:

curl -X POST https://target.com/couch/recaptcha-verify.php \
  -d "secret=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe&response=fake_response_token"

Expected Output: The server will accept the fake response, allowing the attacker to bypass CAPTCHA protection.

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to couch/config.example.php (if exposed).
• Alert on reCAPTCHA verification requests using the known test keys.
• Use the Sigma rule below to detect exploitation attempts.

Defense:

• Immediately override the default keys in production by setting environment variables or editing the configuration file.
• Restrict access to couch/config.example.php via .htaccess or web server rules.
• Implement logging for all reCAPTCHA verification attempts.

Indicators of Compromise (IOCs)

• Static IPs/URLs: None specific; depends on attacker infrastructure.
• File Hashes (config.example.php):
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
  • SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
• Network Patterns:
  • POST requests to /couch/recaptcha-verify.php with parameters secret=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe.
• Log Entries:
  • Successful reCAPTCHA verification with the test secret key.

Detection Engineering

YARA Rule

rule CVE_2025_15005_Hardcoded_Keys {
    meta:
        description = "Detects hard-coded reCAPTCHA keys in CouchCMS config.example.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15005"
    strings:
        $key1 = "K_RECAPTCHA_SITE_KEY"
        $key2 = "K_RECAPTCHA_SECRET_KEY"
        $test_key1 = "6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI"
        $test_key2 = "6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe"
    condition:
        all of ($key*) and any of ($test_key*)
}

Sigma Rule

title: CVE-2025-15005 - Hard-coded reCAPTCHA Key Usage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts using known hard-coded reCAPTCHA keys
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/couch/recaptcha-verify.php'
        cs-params|contains: 'secret=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe'
    condition: selection
falsepositives:
    - Legitimate testing with Google's test keys
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-15005 - Hard-coded reCAPTCHA Key Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/couch/recaptcha-verify.php"; http_uri;
    content:"secret=6LeIxAcTAAAAAGG-vFI1TnRWxMZNFuojJ4WifJWe"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Override Default Keys: Set environment variables RECAPTCHA_SITE_KEY and RECAPTCHA_SECRET_KEY with your own Google reCAPTCHA keys.
2. Restrict File Access: Block direct access to couch/config.example.php using web server rules (e.g., Apache .htaccess):

   <Files "config.example.php">
       Require all denied
   </Files>
   

3. Update Configuration: Edit couch/config.php (if exists) to use environment variables instead of hard-coded values.

Long-term Fix:

• Apply the patched code shown in the "Vulnerable vs. Patched Code" section.
• Monitor the CouchCMS project for an official patch.

Workaround:

• If unable to modify code, use a web application firewall (WAF) to block requests containing the known test keys.

Valters IT