CVE-2025-47699

Executive Summary

CVE-2025-47699 is a critical vulnerability in Gallagher Command Centre Server's Morpho integration, exposing sensitive system information to unauthorized control spheres (CWE-497). An authenticated operator with limited site permissions can exploit this flaw to make critical changes to local Morpho devices, potentially compromising physical security systems. The vulnerability affects multiple versions of Command Centre Server, with a CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No public proof-of-concept (PoC) or exploit code is currently available, but the high severity demands immediate attention.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary software issue within Gallagher's Command Centre Server ecosystem, specifically the Morpho integration component. Organizations using Gallagher systems should verify their software versions and apply patches from official channels.

CVSS Breakdown & Threat Level

• CVSS Score: 9.9 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs authenticated access with limited permissions.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Changed (S:C) – Impact extends beyond the vulnerable component.
• Confidentiality: High (C:H) – Sensitive system information exposed.
• Integrity: High (I:H) – Critical changes to Morpho devices possible.
• Availability: High (A:H) – Potential disruption of physical security systems.

Threat Level: Critical. Exploitation could allow attackers to manipulate physical access control systems, bypass security perimeters, or cause denial of service.

Deep Dive & Mechanics

The vulnerability resides in the Gallagher Morpho integration, which connects Command Centre Server with Morpho biometric devices. The integration improperly exposes sensitive system information (CWE-497) to authenticated users with limited site permissions. This exposure allows an attacker to:

1. Enumerate System Details: Retrieve configuration data, device credentials, or network topology.
2. Escalate Privileges: Use exposed information to gain higher-level access.
3. Modify Device Settings: Make unauthorized changes to Morpho devices, such as altering access rules, disabling alarms, or adding rogue users.

The flaw likely stems from insufficient authorization checks in API endpoints or configuration interfaces that handle Morpho device management. An authenticated operator with "site" level permissions can access functions intended for "system" administrators.

Vulnerable vs. Patched Code

No specific code snippets are available due to the proprietary nature of Gallagher software. However, the patch addresses authorization logic in the Morpho integration module. Vulnerable versions allow API calls like:

GET /api/morpho/devices/{id}/config

to return sensitive data without verifying the user's role. Patched versions enforce role-based access control (RBAC), requiring "system administrator" privileges for such operations.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Authenticated access to Command Centre Server with limited site permissions.
• Network connectivity to the server (typically on port 443 or 8443).

Exploitation Steps:

1. Enumerate Endpoints: Identify Morpho integration API endpoints using directory brute-forcing or documentation.
2. Extract Sensitive Data: Send authenticated requests to endpoints like /api/morpho/devices or /api/morpho/config to retrieve device credentials and settings.
3. Modify Device Configuration: Use extracted credentials to send malicious configuration changes, e.g., disabling biometric verification.

Example Request (hypothetical):

curl -X GET https://target-server/api/morpho/devices \
  -H "Authorization: Bearer <limited_token>" \
  -H "Content-Type: application/json"

Response (exposed sensitive data):

{
  "devices": [
    {
      "id": "morpho-001",
      "ip": "192.168.1.100",
      "admin_password": "plaintext_password",
      "config": { "access_mode": "biometric_only" }
    }
  ]
}

Blue Team (Defensive)

Detection:

• Monitor for unusual API calls to /api/morpho/* endpoints from users with limited permissions.
• Alert on configuration changes to Morpho devices outside of maintenance windows.
• Use SIEM rules to detect repeated access to sensitive endpoints.

Hunting:

• Review logs for GET /api/morpho/devices or POST /api/morpho/devices/{id}/config from non-admin accounts.
• Check for failed authorization attempts followed by successful data retrieval.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual API requests to /api/morpho/* endpoints.
  • Outbound connections from Command Centre Server to unknown IPs (data exfiltration).
• System IOCs:
  • Unexpected changes to Morpho device configurations.
  • New user accounts or modified access rules in Command Centre.
• Log IOCs:
  • Repeated 401 Unauthorized followed by 200 OK on Morpho endpoints.
  • Log entries with user_role: operator accessing admin-level functions.

Detection Engineering

YARA Rule

rule CVE_2025_47699_Morpho_Exposure {
    meta:
        description = "Detects exposure of sensitive Morpho device configuration data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47699"
    strings:
        $s1 = "/api/morpho/devices" ascii wide nocase
        $s2 = "admin_password" ascii wide nocase
        $s3 = "access_mode" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Gallagher Morpho Integration Sensitive Data Exposure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-47699 by accessing Morpho device configuration endpoints
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47699
logsource:
    category: web_server
    product: gallagher_command_centre
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/morpho/'
        cs-username|endswith: 'operator'
    condition: selection
falsepositives:
    - Legitimate administrative actions during maintenance
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-47699 Gallagher Morpho Integration Sensitive Data Exposure";
    flow:to_server,established;
    content:"/api/morpho/"; http_uri; nocase;
    content:"Authorization"; http_header; nocase;
    pcre:"/Bearer\s+[A-Za-z0-9\-._~+/]+/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-47699;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Software: Apply the latest patches from Gallagher:
   • Upgrade to Command Centre Server vEL9.30.2482 (MR2) or later.
   • For older versions, upgrade to the respective MR releases: vEL9.20.2819 (MR4), vEL9.10.3672 (MR7), vEL9.00.3831 (MR8).
2. Restrict Access: Limit API access to Morpho integration endpoints to only system administrators.
3. Monitor Logs: Enable detailed logging for all API calls and review for suspicious activity.

Long-term Mitigations:

• Implement network segmentation to isolate Command Centre Server from untrusted networks.
• Use multi-factor authentication (MFA) for all administrative accounts.
• Conduct regular security audits of Gallagher systems.

Workarounds (if patching is delayed):

• Disable the Morpho integration temporarily if not critical.
• Apply strict firewall rules to allow only trusted IPs to access the server.

Valters IT
Securing Digital Frontiers