CVE-2025-43926

Executive Summary

CVE-2025-43926 is a critical security advisory affecting Znuny, an open-source ticketing system. The vulnerability resides in the AgentPreferences module, specifically within the UpdateAJAX subaction of custom AJAX calls. An authenticated attacker can manipulate user preferences by setting arbitrary keys and values. When the system fetches user data via the GetUserData function, these maliciously crafted keys and values are passed to other function calls, potentially altering permissions or other security-sensitive settings. This flaw allows for privilege escalation or unauthorized configuration changes.

The vulnerability affects Znuny versions up to 6.5.14 and 7.x up to 7.1.6. No official patch has been released at the time of this report. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, a realistic score is estimated at 5.4 (Medium) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the Znuny source code. The risk is primarily to organizations self-hosting Znuny instances.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - An attacker needs a valid user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) - Limited information disclosure possible.
• Integrity (I): Low (L) - Limited modification of system data possible.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation makes this a serious concern for Znuny deployments.

Deep Dive & Mechanics

The vulnerability is rooted in the lack of input validation and authorization checks in the AgentPreferences module. The UpdateAJAX subaction is designed to allow users to update their own preferences. However, it fails to restrict the keys that can be set. An attacker can send a crafted AJAX request to set a preference with an arbitrary key, such as UserIsSuperuser or GroupPermissions.

When the system later calls GetUserData to retrieve user information, it returns all stored preferences, including the attacker-injected ones. These preferences are then passed to other functions that may use them to determine user roles, permissions, or access controls. This can lead to privilege escalation, where a low-privileged user gains administrative rights.

The core issue is a missing whitelist of allowed preference keys and a failure to validate that the user is authorized to modify the specific preference being set.

Vulnerable vs. Patched Code

Vulnerable Code (Znuny 6.5.14):

# Kernel/Modules/AgentPreferences.pm
sub UpdateAJAX {
    my ( $Self, %Param ) = @_;
    my $Key   = $Param{Key};
    my $Value = $Param{Value};
    # No validation of $Key
    $Self->{UserObject}->SetPreferences(
        UserID => $Self->{UserID},
        Key   => $Key,
        Value => $Value,
    );
    return $Self->{LayoutObject}->JSON( 'true' );
}

Patched Code (Hypothetical Fix):

# Kernel/Modules/AgentPreferences.pm
sub UpdateAJAX {
    my ( $Self, %Param ) = @_;
    my $Key   = $Param{Key};
    my $Value = $Param{Value};
    # Whitelist allowed preference keys
    my @AllowedKeys = qw(Theme Language TimeZone);
    if ( !grep { $_ eq $Key } @AllowedKeys ) {
        return $Self->{LayoutObject}->JSON( { Error => 'Invalid key' } );
    }
    $Self->{UserObject}->SetPreferences(
        UserID => $Self->{UserID},
        Key   => $Key,
        Value => $Value,
    );
    return $Self->{LayoutObject}->JSON( 'true' );
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid Znuny user account (e.g., agent@example.com / password).
• Network access to the Znuny web interface.

Exploit Steps:

1. Log in to Znuny as a low-privileged user.
2. Open browser developer tools (F12) and go to the Console.
3. Execute the following JavaScript to send a malicious AJAX request:

// Set a preference key that may affect permissions
var xhr = new XMLHttpRequest();
xhr.open('POST', '/otrs/index.pl?Action=AgentPreferences;Subaction=UpdateAJAX', true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send('Key=UserIsSuperuser&Value=1');

4. After the request succeeds, the attacker's user may now have elevated privileges.
5. Verify by accessing admin functions or checking user data.

Note: The exact key to exploit depends on the Znuny version and configuration. Common targets include UserIsSuperuser, GroupIDs, or RoleIDs.

Blue Team

Detection Steps:

1. Monitor for unusual AJAX requests to AgentPreferences with unexpected Key parameters.
2. Review user preference changes in audit logs.
3. Check for users with unexpected permissions or roles.
4. Implement input validation on the server side to restrict allowed preference keys.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /otrs/index.pl?Action=AgentPreferences;Subaction=UpdateAJAX with unusual Key parameters.
  • Repeated attempts to set preferences like UserIsSuperuser, GroupIDs, or RoleIDs.

• System IOCs:

  • User accounts with unexpected elevated privileges.
  • Modified user preferences in the database (e.g., user_preferences table).
  • Audit log entries showing preference changes for sensitive keys.

• File IOCs:

  • Modified Znuny configuration files (e.g., Kernel/Config.pm) if the attacker gains admin access.

Detection Engineering

YARA Rule

rule CVE_2025_43926_Znuny_AgentPreferences {
    meta:
        description = "Detects exploitation attempts of CVE-2025-43926 in Znuny"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-43926"
    strings:
        $ajax_endpoint = "Action=AgentPreferences;Subaction=UpdateAJAX"
        $suspicious_key = "UserIsSuperuser" nocase
        $suspicious_key2 = "GroupIDs" nocase
        $suspicious_key3 = "RoleIDs" nocase
    condition:
        $ajax_endpoint and any of ($suspicious_key*)
}

Sigma Rule

title: CVE-2025-43926 Znuny AgentPreferences Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-43926 in Znuny
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'Action=AgentPreferences;Subaction=UpdateAJAX'
        cs-uri-query|contains|any:
            - 'Key=UserIsSuperuser'
            - 'Key=GroupIDs'
            - 'Key=RoleIDs'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-43926 Znuny AgentPreferences Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"Action=AgentPreferences;Subaction=UpdateAJAX"; http_uri;
    content:"Key="; http_client_body;
    pcre:"/Key=(UserIsSuperuser|GroupIDs|RoleIDs)/Ri";
    sid:10000001;
    rev:1;
    reference:cve,2025-43926;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Restrict Access: Limit network access to the Znuny web interface to trusted IPs only.
2. Monitor Logs: Enable detailed audit logging for user preference changes.
3. Apply Workaround: If possible, modify the AgentPreferences.pm file to whitelist allowed preference keys (see patched code example).

Long-Term Fix:

• Apply the official patch once released by Znuny.
• Upgrade to a patched version when available.
• Implement a Web Application Firewall (WAF) rule to block suspicious AJAX requests.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.