CVE-2025-41402

Executive Summary

CVE-2025-41402 is a Client-Side Enforcement of Server-Side Security vulnerability (CWE-602) in Gallagher’s Command Centre Server. A privileged operator can bypass expiry checks on competency data by manipulating client-side validation, allowing invalid competency records to be entered into the system. This undermines the integrity of access control and personnel management, potentially leading to unauthorized physical access or compliance failures. The vulnerability affects multiple versions of the Command Centre Server, with patches available for the 9.10, 9.20, and 9.30 release lines. No public proof-of-concept or exploit code has been identified at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
• Attack Vector: Local (AV:L) – The attacker must have local access to the Command Centre Server.
• Attack Complexity: Low (AC:L) – No special conditions are required to exploit.
• Privileges Required: High (PR:H) – The attacker must be a privileged operator.
• User Interaction: None (UI:N) – No user interaction is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data disclosure.
• Integrity Impact: High (I:H) – Competency data can be manipulated, bypassing expiry checks.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires high privileges but can lead to significant integrity violations in access control systems.

Deep Dive & Mechanics

The vulnerability lies in the client-side enforcement of server-side security for competency data validation. In Gallagher Command Centre, competency records (e.g., certifications, training, or access permissions) have expiry dates. The server relies on the client (operator workstation) to enforce that only valid (non-expired) competency data is entered. However, a privileged operator can intercept or modify the client-side validation logic, allowing them to submit competency records with invalid or expired dates.

Root Cause: The server does not independently validate the expiry date of competency data submitted by the client. Instead, it trusts the client to have performed this check. This is a classic CWE-602 flaw.

Attack Scenario:

1. A privileged operator (e.g., security administrator) logs into the Command Centre Server.
2. The operator uses a debugger, proxy, or modified client to bypass the client-side expiry check.
3. The operator submits a competency record with an expired date or invalid data.
4. The server accepts the record without re-validating the expiry, storing invalid data in the database.

Impact: Invalid competency records can lead to:

• Granting access to personnel whose certifications have expired.
• Compliance violations (e.g., in regulated industries).
• Weakened physical security posture.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Client-side validation only
function validateCompetency(competency) {
    if (competency.expiryDate < new Date()) {
        return false; // Client-side check
    }
    return true;
}

// Server-side (vulnerable) - trusts client
function submitCompetency(competency) {
    // No server-side expiry validation
    database.save(competency);
}

Patched Code (Conceptual):

// Client-side validation (still present)
function validateCompetency(competency) {
    if (competency.expiryDate < new Date()) {
        return false;
    }
    return true;
}

// Server-side (patched) - validates independently
function submitCompetency(competency) {
    if (competency.expiryDate < new Date()) {
        throw new Error("Competency expired");
    }
    database.save(competency);
}

The patch adds server-side validation of the expiry date, ensuring that even if the client is compromised, the server rejects invalid data.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a Gallagher Command Centre Server (vulnerable version).
• Privileged operator credentials.
• Ability to modify client-side code (e.g., using browser developer tools, Fiddler, or a custom client).

Exploitation Steps:

1. Log in to the Command Centre Server as a privileged operator.
2. Open the competency management interface.
3. Use a web proxy (e.g., Burp Suite) to intercept the request when adding a new competency.
4. Modify the expiryDate parameter to a past date (e.g., 2020-01-01).
5. Forward the modified request to the server.
6. The server accepts the request and stores the invalid competency.

Proof-of-Concept (Python script using requests):

import requests

url = "https://target-server/competency/add"
cookies = {"session": "valid_session_token"}
data = {
    "employee_id": "12345",
    "competency_type": "Security Clearance",
    "expiry_date": "2020-01-01"  # Expired date
}
response = requests.post(url, cookies=cookies, data=data, verify=False)
print(response.status_code)  # Should be 200 if vulnerable

Blue Team (Detection & Prevention)

Detection:

• Monitor for anomalous competency submissions with past expiry dates.
• Log all competency modifications and alert on any that bypass client-side validation.
• Use network monitoring to detect modified requests (e.g., unusual expiry_date values).

Prevention:

• Apply the vendor patch immediately.
• Implement additional server-side validation for all competency data.
• Restrict privileged operator accounts to only those who require them.
• Enable audit logging for all competency changes.

Indicators of Compromise (IOCs)

• Log Entries: Competency records with expiry_date values in the past.
• Network Traffic: HTTP requests to /competency/add or similar endpoints with modified expiry_date parameters.
• Database Records: Competency entries where expiry_date < CURRENT_DATE.
• User Activity: Unusual patterns of competency modifications by privileged operators.

Detection Engineering

YARA Rule

rule CVE_2025_41402_Competency_Bypass {
    meta:
        description = "Detects attempts to bypass competency expiry validation in Gallagher Command Centre"
        author = "Valters IT"
        date = "2025-04-17"
        cve = "CVE-2025-41402"
    strings:
        $s1 = "expiry_date" ascii wide nocase
        $s2 = "competency" ascii wide nocase
        $s3 = "add" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Gallagher Command Centre Competency Expiry Bypass
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-41402 by monitoring for competency submissions with past expiry dates.
author: Valters IT
date: 2025-04-17
logsource:
    product: gallagher_command_centre
    service: audit_log
detection:
    selection:
        EventID: 1234  # Example event ID for competency modification
        Data|contains: "expiry_date"
        Data|re: "19[0-9]{2}-[0-9]{2}-[0-9]{2}|20[0-1][0-9]-[0-9]{2}-[0-9]{2}"  # Past dates
    condition: selection
falsepositives:
    - Legitimate corrections of expired competencies (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-41402 Gallagher Competency Bypass"; flow:to_server,established; content:"POST"; http_method; content:"/competency/add"; http_uri; content:"expiry_date"; http_client_body; pcre:"/expiry_date=[0-9]{4}-[0-9]{2}-[0-9]{2}/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the patched versions:
   • 9.30: vEL9.30.2482 (MR2)
   • 9.20: vEL9.20.2819 (MR4)
   • 9.10: vEL9.10.3672 (MR7)
2. If immediate patching is not possible, implement compensating controls:
   • Restrict privileged operator accounts.
   • Enable detailed audit logging for competency changes.
   • Monitor for anomalous competency submissions.

Long-Term Measures:

• Conduct a security review of all client-server validation logic.
• Implement server-side validation for all critical data.
• Follow the principle of least privilege for operator accounts.

Workarounds:

• No official workaround exists; patching is required.

Valters IT