CVE-2025-46544

Executive Summary

CVE-2025-46544 is a privilege escalation vulnerability in Sherpa Orchestrator build 141851. A low-privileged user can create new users and roles, effectively elevating their privileges to administrative levels. This flaw allows an attacker with minimal access to gain full control over the orchestrator, potentially leading to data breaches, service disruption, or lateral movement within the infrastructure. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code is available.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary software component (Sherpa Orchestrator). Supply chain risks are limited to the vendor's distribution channels.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid low-privileged account.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected system.
• Confidentiality (C): High (H) – Full read access to sensitive data.
• Integrity (I): High (H) – Full write access to system data.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The vulnerability requires authentication but allows a low-privileged user to gain full administrative control. The lack of a patch increases the risk.

Deep Dive & Mechanics

The vulnerability resides in the user and role management module of Sherpa Orchestrator build 141851. The application fails to enforce proper authorization checks when low-privileged users attempt to create new users or roles. Specifically, the API endpoints responsible for user creation and role assignment do not validate whether the requesting user has administrative privileges.

Root Cause: Missing server-side authorization checks on user/role creation endpoints. The application relies on client-side restrictions, which can be bypassed by directly sending crafted HTTP requests.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., viewer).
2. Attacker sends a POST request to /api/users with a payload containing a new admin user.
3. The server processes the request without verifying the requester's role.
4. The new admin user is created, granting the attacker full control.

Affected Component: User and Role Management API.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the only reference. The following is a conceptual representation of the flawed authorization logic.

Vulnerable Code (Conceptual):

@app.route('/api/users', methods=['POST'])
def create_user():
    # Missing authorization check
    data = request.get_json()
    username = data['username']
    role = data['role']
    # Directly creates user without checking if requester is admin
    db.create_user(username, role)
    return jsonify({"status": "success"}), 201

Patched Code (Conceptual):

@app.route('/api/users', methods=['POST'])
def create_user():
    # Authorization check added
    if not current_user.is_admin():
        return jsonify({"error": "Unauthorized"}), 403
    data = request.get_json()
    username = data['username']
    role = data['role']
    db.create_user(username, role)
    return jsonify({"status": "success"}), 201

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Access to a Sherpa Orchestrator instance (build 141851).
• Valid low-privileged credentials (e.g., viewer:password).

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Send a crafted POST request to create a new admin user.

Example Request:

curl -X POST https://target-sherpa.com/api/users \
  -H "Authorization: Bearer <low_priv_token>" \
  -H "Content-Type: application/json" \
  -d '{"username": "hacker", "role": "admin", "password": "P@ssw0rd!"}'

Expected Outcome: The server returns HTTP 201 and creates the user. The attacker can then log in as hacker with admin privileges.

Blue Team (Defensive)

Detection:

• Monitor for unusual user creation events, especially from non-admin accounts.
• Alert on API calls to /api/users or /api/roles from low-privileged users.
• Review logs for HTTP 201 responses to user creation endpoints from unexpected sources.

Hunting Query (Splunk):

index=main sourcetype=sherpa_api
method=POST uri=/api/users
status=201
| where NOT user_role IN ("admin", "superadmin")
| table _time, user, user_role, new_username, new_role

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/users or /api/roles with JSON payloads containing "role": "admin".
  • Unusual user agent strings or IP addresses performing user creation.
• System:
  • New user accounts with administrative roles created outside of normal business hours.
  • Log entries showing user creation by non-admin accounts.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule sherpa_priv_esc_user_creation {
    meta:
        description = "Detects attempts to exploit CVE-2025-46544 by creating admin users"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46544"
    strings:
        $json_payload = /"role"\s*:\s*"admin"/ nocase
        $api_endpoint = "/api/users"
    condition:
        $api_endpoint and $json_payload
}

Sigma Rule

title: Suspicious User Creation in Sherpa Orchestrator
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects low-privileged users creating new admin accounts (CVE-2025-46544)
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: sherpa_orchestrator
detection:
    selection:
        http_method: POST
        uri: /api/users
        response_status: 201
    filter:
        user_role: admin
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions (should be rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46544 - Sherpa Orchestrator Privilege Escalation via User Creation"; flow:to_server; content:"POST"; http_method; content:"/api/users"; http_uri; content:"\"role\":\"admin\""; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable User Self-Service: If possible, disable the user creation API for non-admin users until a patch is available.
2. Network Segmentation: Restrict access to the Sherpa Orchestrator management interface to trusted IPs only.
3. Monitor Logs: Enable detailed logging and alerting on user creation events.

Long-Term Fix:

• Apply vendor patch when released.
• Implement proper role-based access control (RBAC) with server-side authorization checks.
• Conduct a security audit of all API endpoints.

Workaround:

• Use a Web Application Firewall (WAF) to block POST requests to /api/users and /api/roles from non-admin source IPs.

Valters IT
Securing Digital Frontiers