CVE-2025-35981

Executive Summary

CVE-2025-35981 is a vulnerability in Gallagher Command Centre Server that allows a privileged Operator to view limited personal data about a Cardholder they would not normally have permissions to view. This is an Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) issue. The vulnerability affects versions 9.30.1874 (MR1), 9.20.2337 (MR3), and 9.10.3194 (MR6). The CVSS score is 5.5 (Medium), with a local attack vector and high privileges required. No public proof-of-concept or exploit code is available at this time. The patch status is unknown/unpatched.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have local access to the Command Centre Server.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required.
• Privileges Required (PR): High (H) – The attacker must already have Operator-level privileges.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Personal data of Cardholders is exposed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The vulnerability requires high privileges, limiting the attack surface to insiders or compromised Operator accounts. However, the exposure of personal data (PII) can lead to privacy breaches and regulatory fines.

Deep Dive & Mechanics

The vulnerability resides in the Command Centre Server's access control logic for viewing Cardholder personal information. Under normal operation, Operators are assigned permissions that restrict which Cardholder data they can view based on organizational roles or security zones. However, due to a flaw in the permission enforcement mechanism, a privileged Operator can bypass these restrictions and view limited personal data (e.g., name, card number, or other PII) of Cardholders outside their authorized scope.

The root cause is likely an improper check in the server-side code that handles data retrieval requests. When an Operator queries Cardholder details, the server fails to validate whether the requesting user has the necessary permissions for the specific Cardholder record. This could be due to:

• Missing or incomplete authorization checks in the API endpoint.
• Incorrect use of role-based access control (RBAC) filters.
• A race condition or caching issue that allows stale permissions to be used.

The vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The affected versions are limited to specific maintenance releases (MR1, MR3, MR6) of the 9.30, 9.20, and 9.10 branches.

Vulnerable vs. Patched Code

Since no patch is available, a hypothetical fix would involve adding proper authorization checks before returning Cardholder data. Below is a conceptual comparison:

Vulnerable Code (C# example):

public CardholderData GetCardholderData(int cardholderId, User currentUser)
{
    // Missing permission check
    var cardholder = _dbContext.Cardholders.Find(cardholderId);
    return cardholder;
}

Patched Code (C# example):

public CardholderData GetCardholderData(int cardholderId, User currentUser)
{
    // Check if user has permission to view this cardholder
    if (!_authorizationService.CanViewCardholder(currentUser, cardholderId))
    {
        throw new UnauthorizedAccessException("Insufficient permissions.");
    }
    var cardholder = _dbContext.Cardholders.Find(cardholderId);
    return cardholder;
}

The patched version adds a call to CanViewCardholder which verifies the user's permissions against the specific Cardholder record before returning data.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Gallagher Command Centre Server (version 9.30.1874, 9.20.2337, or 9.10.3194).
• An Operator account with high privileges (e.g., System Administrator or equivalent).

Exploitation Steps:

1. Log in to the Command Centre Client with the privileged Operator account.
2. Navigate to the Cardholder management section.
3. Use the search or browse functionality to query Cardholders outside your normal scope.
4. Observe that the server returns personal data (e.g., name, card number) for Cardholders you should not have access to.
5. Extract the data manually or via script.

Proof-of-Concept (Python script):

import requests

# Assuming the Command Centre API endpoint
url = "https://target-server/api/cardholders/12345"
headers = {"Authorization": "Bearer <operator_token>"}

response = requests.get(url, headers=headers, verify=False)
if response.status_code == 200:
    print("Cardholder data:", response.json())
else:
    print("Failed to retrieve data")

Blue Team

Detection Steps:

1. Monitor for unusual access patterns to Cardholder data, especially from Operator accounts that normally do not access certain records.
2. Enable audit logging on the Command Centre Server to track all data retrieval requests.
3. Review logs for repeated queries to Cardholder IDs outside the Operator's typical scope.
4. Implement alerts for any access to Cardholder data by accounts with high privileges that are not part of normal operations.

Honeypot Setup:

• Create fake Cardholder records with unique identifiers.
• Monitor for any access to these records by unauthorized Operators.

Indicators of Compromise (IOCs)

• Log Entries: Unusual access to Cardholder data by Operator accounts with high privileges.
• Network Traffic: API calls to /api/cardholders/ with unexpected Cardholder IDs.
• User Behavior: Operators querying Cardholder data outside their normal scope.
• File Artifacts: Exported CSV or Excel files containing Cardholder data from unauthorized sources.

Detection Engineering

YARA Rule

rule CVE_2025_35981_Cardholder_Data_Exposure {
    meta:
        description = "Detects potential exploitation of CVE-2025-35981 by identifying access to Cardholder data outside normal scope"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35981"
    strings:
        $api_call = "/api/cardholders/" ascii wide nocase
        $operator_token = "Bearer" ascii wide nocase
        $cardholder_data = "cardholderId" ascii wide nocase
    condition:
        $api_call and $operator_token and $cardholder_data
}

Sigma Rule

title: CVE-2025-35981 - Unauthorized Cardholder Data Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-35981 by accessing Cardholder data outside normal permissions
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-35981
logsource:
    product: gallagher
    service: command_centre
detection:
    selection:
        EventID: 4663
        ObjectName: '*Cardholder*'
        AccessMask: 'ReadData'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-35981 - Unauthorized Cardholder Data Access"; flow:to_server,established; content:"/api/cardholders/"; http_uri; nocase; content:"Authorization|3a| Bearer"; http_header; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Operator privileges to the minimum necessary for their role.
2. Enable and review audit logs for any suspicious access to Cardholder data.
3. Implement network segmentation to limit access to the Command Centre Server.

Long-term Fix:

• Apply the official patch from Gallagher when available.
• Upgrade to a patched version of Command Centre Server.
• Implement additional access controls, such as multi-factor authentication for Operator accounts.

Workarounds:

• If patching is not possible, consider disabling the Cardholder data view feature for non-essential Operators.
• Use a web application firewall (WAF) to block suspicious API calls.

Valters IT
Securing Your Digital Frontier