CVE-2025-49135

Executive Summary

CVE-2025-49135 is an authorization bypass vulnerability in CVAT (Computer Vision Annotation Tool), an open-source interactive video and image annotation platform. The flaw resides in the project and task import functionality, where the application fails to validate that a TUS-uploaded file specified in a query parameter belongs to the requesting user. An authenticated attacker with a user role can exploit this by referencing another user's uploaded file by its known filename, thereby importing and exfiltrating sensitive annotation data. The vulnerability affects CVAT versions 2.2.0 through 2.39.0. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low active exploitation. The vendor has released a patch in version 2.40.0.

Supply Chain & Package Security

CVAT is distributed as a Python/Django application via Docker images and source code on GitHub. The vulnerability does not directly affect the software supply chain (e.g., PyPI packages), but organizations using CVAT as part of their ML pipeline should treat this as a critical data confidentiality risk. The patch is available in the official GitHub repository, and users should update their deployments immediately.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires an authenticated user account
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – sensitive annotation data can be stolen
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.5, the actual risk is elevated due to the ease of exploitation (low complexity, no user interaction) and the potential for data theft in environments where CVAT handles proprietary or sensitive datasets.

Deep Dive & Mechanics

The vulnerability is rooted in the project and task import endpoints. CVAT uses TUS (Resumable Upload Protocol) for file uploads. When a user uploads a file (e.g., a project backup), the file is stored on the server with a unique filename. The import process accepts a query parameter (e.g., ?filename=...) to specify which uploaded file to import. The flaw is that the server does not verify that the file referenced by the filename belongs to the authenticated user. An attacker can enumerate or guess filenames of other users' uploads and then craft a request to import that file as their own project or task, thereby gaining access to the data.

Key Components:

• TUS Upload Endpoint: Handles file uploads and returns a filename.
• Import Endpoint: Accepts a filename parameter and processes the file.
• Missing Authorization Check: No ownership validation between the authenticated user and the file.

Attack Flow:

1. Attacker logs into CVAT with a valid user role account.
2. Attacker identifies or guesses a filename of another user's upload (e.g., via directory traversal, error messages, or brute-force).
3. Attacker sends a POST request to /api/projects/import?filename=<target_filename>.
4. The server imports the file, making the data accessible to the attacker.

Vulnerable vs. Patched Code

Vulnerable Code (CVAT < 2.40.0):

# views.py (simplified)
def import_project(request):
    filename = request.GET.get('filename')
    # No ownership check
    file_path = os.path.join(TUS_UPLOAD_DIR, filename)
    # Process file...

Patched Code (CVAT >= 2.40.0):

# views.py (simplified)
def import_project(request):
    filename = request.GET.get('filename')
    # Ownership validation
    upload = TUSUpload.objects.get(filename=filename, user=request.user)
    file_path = upload.file_path
    # Process file...

The patch adds a database query to ensure the TUS upload record is associated with the current user before proceeding.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A CVAT instance running version 2.2.0 to 2.39.0.
• An authenticated user account with user role.
• Knowledge of a target filename (e.g., backup_2025-03-15.zip).

Exploitation Steps:

1. Identify Target Filename: Use directory enumeration or error-based leaks to discover filenames. Example: GET /api/tus/upload?filename=../../uploads/backup_2025-03-15.zip might reveal a path.
2. Craft Import Request:

   curl -X POST "https://target-cvat.com/api/projects/import?filename=backup_2025-03-15.zip" \
     -H "Authorization: Token <attacker_token>" \
     -H "Content-Type: application/json"
   

3. Verify Data Access: The imported project will appear in the attacker's workspace, allowing data exfiltration.

Note: No public exploit code exists. The above is a conceptual demonstration.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual import requests where the filename parameter does not match the user's own upload history.
• Alert on multiple failed import attempts (HTTP 403/404) from the same user.
• Enable audit logging for all import operations.

Defense:

• Immediately upgrade to CVAT 2.40.0 or later.
• If upgrade is not possible, implement a WAF rule to block import requests with filenames not matching the user's session.
• Restrict TUS upload directory permissions to prevent directory listing.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /api/projects/import or /api/tasks/import with a filename parameter.
  • Repeated 403/404 responses from import endpoints.
• File IOCs:
  • Unexpected project/task imports in user activity logs.
  • Files in the TUS upload directory accessed by users other than the owner.
• Log IOCs:
  • Log entries showing import_project or import_task with mismatched user IDs.

Detection Engineering

YARA Rule

rule CVE_2025_49135_CVAT_Import_Bypass {
    meta:
        description = "Detects CVAT import requests without ownership validation"
        author = "Valters IT"
        date = "2025-03-15"
        reference = "CVE-2025-49135"
    strings:
        $import_path = "/api/projects/import" or "/api/tasks/import"
        $filename_param = "filename="
    condition:
        $import_path and $filename_param
}

Sigma Rule

title: CVE-2025-49135 - CVAT Unauthorized Import Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to import projects/tasks with a filename parameter that may indicate unauthorized access.
author: Valters IT
date: 2025-03-15
logsource:
    category: web
    product: cvat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/projects/import'
            - '/api/tasks/import'
        cs-uri-query|contains: 'filename='
    condition: selection
falsepositives:
    - Legitimate imports by the same user
level: medium
tags:
    - attack.t1190
    - cve.2025.49135

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49135 - CVAT Unauthorized Import Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/projects/import"; http_uri;
    content:"filename="; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-49135;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CVAT to version 2.40.0 or later. This is the only complete fix.
2. Apply WAF Rules: Block import requests where the filename does not match the user's own uploads (requires custom logic).
3. Restrict TUS Upload Directory: Ensure the upload directory is not world-readable and disable directory listing.

Long-Term Measures:

• Implement strict authorization checks for all file operations.
• Conduct a security audit of all import/export endpoints.
• Enable comprehensive logging and monitoring for file access.

Workarounds:

• No known workarounds exist. The only reliable mitigation is the patch.

Valters IT