CVE-2025-54966

Executive Summary

CVE-2025-54966 is an information disclosure vulnerability in BAE Systems SOCET GXP, a geospatial intelligence (GEOINT) analysis platform. The flaw resides in the Job Status Service, where certain endpoints inadvertently expose sensitive data, including local file system paths and the exact version of the SOCET GXP installation. This leakage can aid an attacker in reconnaissance, enabling targeted attacks against the underlying infrastructure or specific software versions with known vulnerabilities. The vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the practical risk is elevated due to the sensitive nature of the exposed information. No public exploit code or proof-of-concept is available at this time.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Network (likely)
• Attack Complexity: Low
• Privileges Required: None (likely)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (exposes file paths and version info)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium (information leakage aiding further attacks)

Deep Dive & Mechanics

The SOCET GXP Job Status Service is a web-based component that provides status updates on processing jobs. The vulnerability arises from improper sanitization of error messages or debug responses. When a request is made to certain endpoints (e.g., job status queries with malformed parameters), the service returns verbose error messages containing internal file paths (e.g., C:\Program Files\BAE\SOCET GXP\...) and the exact software version (e.g., 4.5.0.1). This information is not intended for external users and can be harvested by an attacker without authentication.

The root cause is likely a misconfiguration in the web server or application logic that fails to strip sensitive details from error responses. The exposure of file paths reveals the directory structure, aiding in path traversal or file inclusion attacks. The version disclosure allows attackers to identify known vulnerabilities in that specific build.

Vulnerable vs. Patched Code

Vulnerable (pre-4.6.0.2):

# Example of vulnerable error handling in Job Status Service
def get_job_status(job_id):
    try:
        # Process job
        result = process_job(job_id)
        return {"status": "success", "data": result}
    except Exception as e:
        # Verbose error message exposes internal paths
        return {"status": "error", "message": f"Failed to process job {job_id} at {os.getcwd()}: {str(e)}"}

Patched (4.6.0.2+):

# Patched version with sanitized error messages
def get_job_status(job_id):
    try:
        result = process_job(job_id)
        return {"status": "success", "data": result}
    except Exception as e:
        # Generic error message without sensitive details
        return {"status": "error", "message": "An internal error occurred. Please contact support."}

Exploitation & Lab Setup

Red Team

1. Reconnaissance: Identify SOCET GXP instances via Shodan dorks (e.g., "SOCET GXP" or "Job Status Service").
2. Endpoint Discovery: Probe common endpoints like /jobstatus, /api/status, or /version.
3. Trigger Error: Send malformed requests (e.g., invalid job ID, missing parameters) to elicit verbose errors.
4. Extract Data: Parse responses for file paths (e.g., C:\Program Files\BAE\SOCET GXP\...) and version strings (e.g., 4.5.0.1).
5. Weaponize: Use leaked version info to search for known CVEs targeting that specific build.

Lab Setup:

• Install SOCET GXP 4.5.0 (vulnerable) on a Windows Server 2019 VM.
• Expose the Job Status Service on a local network.
• Use curl or Burp Suite to send requests:

  curl -X GET "http://target:8080/jobstatus?id=invalid"
  

• Observe response containing file paths.

Blue Team

1. Detection: Monitor for anomalous requests to Job Status Service endpoints with unusual parameters.
2. Harden: Disable verbose error messages in the application configuration.
3. Patch: Upgrade to SOCET GXP 4.6.0.2 or later.
4. WAF Rules: Block requests containing SQL-like patterns or path traversal attempts.
5. Logging: Enable detailed logging of all API requests and responses for forensic analysis.

Indicators of Compromise (IOCs)

• File Paths: C:\Program Files\BAE\SOCET GXP\*, /opt/BAE/SOCET_GXP/*
• Version Strings: SOCET GXP version 4.5.0.1, 4.6.0.0
• Endpoints: /jobstatus, /api/status, /version
• Error Messages: Failed to process job at C:\..., Error reading file: /opt/...

Detection Engineering

YARA Rule

rule CVE_2025_54966_SOCET_GXP_InfoLeak {
    meta:
        description = "Detects SOCET GXP Job Status Service information disclosure"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54966"
    strings:
        $s1 = "SOCET GXP version" ascii wide nocase
        $s2 = "Failed to process job" ascii wide nocase
        $s3 = "C:\\Program Files\\BAE\\SOCET GXP" ascii wide nocase
        $s4 = "/opt/BAE/SOCET_GXP" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: SOCET GXP Job Status Service Information Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-54966 by probing for sensitive info
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '/jobstatus'
            - '/api/status'
            - '/version'
        sc-status: 200
        cs-uri-query|contains:
            - 'id='
            - 'job='
    condition: selection
falsepositives:
    - Legitimate monitoring tools
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54966 SOCET GXP Info Leak Attempt"; flow:to_server; content:"/jobstatus"; http_uri; nocase; content:"id="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to SOCET GXP version 4.6.0.2 or later.
2. Workaround: If patching is not possible, restrict network access to the Job Status Service using firewall rules or VPN.
3. Configuration: Disable verbose error messages in the application configuration file (e.g., web.config or application.properties).
4. Monitoring: Implement logging and alerting for suspicious requests to the Job Status Service.
5. Vendor Contact: BAE Systems has released a patch; ensure all installations are updated.

Valters IT
DevSecOps & Cyber Threat Intelligence