CVE-2025-70058

Executive Summary

CVE-2025-70058 is a critical security vulnerability in YMFE yapi v1.12.0, an open-source API management platform. The vulnerability stems from improper certificate validation (CWE-295), where the application explicitly disables TLS/SSL certificate verification by setting rejectUnauthorized: false in the HTTPS agent configuration for Axios requests. This allows an attacker to perform man-in-the-middle (MITM) attacks, intercepting and potentially modifying all HTTPS traffic between the yapi server and external APIs. The CVSS score is 0.0 due to incomplete NVD data, but the actual risk is high, as it undermines the entire TLS security model. No official patch is available, and the vendor (Ymfe) has not released a fix.

Supply Chain & Package Security

This vulnerability is not directly related to an NPM, PyPI, Go, or Ruby package, but it affects the YMFE yapi application, which is typically deployed via Node.js and may use npm for dependency management. The insecure configuration is hardcoded in the application source code, not in a third-party package. However, any downstream consumers of yapi’s API or integrations are at risk.

CVSS Breakdown & Threat Level

While the official CVSS score is 0.0 (likely due to incomplete data), the actual severity is high. Based on the vulnerability characteristics:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – no authentication needed.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – the vulnerable component is the only affected entity.
• Confidentiality (C): High (H) – all traffic can be intercepted.
• Integrity (I): High (H) – traffic can be modified.
• Availability (A): High (H) – MITM can disrupt service.

Adjusted CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjusted Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability allows complete compromise of TLS-protected communications, enabling credential theft, data exfiltration, and injection of malicious payloads.

Deep Dive & Mechanics

The vulnerability is located in the Axios HTTP client configuration within YMFE yapi v1.12.0. The application creates an HTTPS agent with rejectUnauthorized: false, which disables certificate validation. This means the Axios client will accept any TLS certificate, including self-signed or malicious ones, without verifying the certificate chain or hostname.

Root Cause: The insecure configuration is likely in a file such as server/utils/axios.js or similar, where the HTTPS agent is instantiated. The code snippet would resemble:

const https = require('https');
const axios = require('axios');

const agent = new https.Agent({
  rejectUnauthorized: false // Disables certificate validation
});

const instance = axios.create({
  httpsAgent: agent
});

Impact: An attacker on the network path (e.g., same Wi-Fi, compromised router, or ISP) can perform a MITM attack. They can present a fake certificate, and the yapi server will accept it, allowing the attacker to decrypt, read, and modify all traffic between yapi and external APIs. This includes API keys, authentication tokens, and sensitive data.

Attack Scenario:

1. Attacker positions themselves between the yapi server and the internet (e.g., ARP spoofing, DNS poisoning).
2. Attacker intercepts HTTPS requests from yapi to external APIs.
3. Attacker presents a self-signed certificate; yapi accepts it due to rejectUnauthorized: false.
4. Attacker decrypts traffic, steals credentials, or injects malicious responses.

Vulnerable vs. Patched Code

Vulnerable Code (yapi v1.12.0):

const https = require('https');
const axios = require('axios');

const agent = new https.Agent({
  rejectUnauthorized: false // INSECURE
});

const instance = axios.create({
  httpsAgent: agent
});

Patched Code (Hypothetical fix):

const https = require('https');
const axios = require('axios');

const agent = new https.Agent({
  rejectUnauthorized: true // SECURE - validates certificates
});

const instance = axios.create({
  httpsAgent: agent
});

Additional hardening: The patched version should also include proper CA certificate configuration and hostname verification. For production, use environment variables to manage certificates.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: YMFE yapi v1.12.0 running on a server (e.g., Ubuntu 22.04).
• Attacker: Kali Linux with MITM tools.
• Network: Same subnet or ARP spoofing.

Exploitation Steps:

1. ARP Spoofing: Use arpspoof to redirect traffic.

   arpspoof -i eth0 -t <target_ip> <gateway_ip>
   arpspoof -i eth0 -t <gateway_ip> <target_ip>
   

2. Set up MITM proxy with SSLstrip+ or mitmproxy:

   mitmproxy --mode transparent --listen-port 8080
   

3. Configure iptables to redirect traffic:

   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
   

4. Capture traffic: The yapi server will accept the mitmproxy certificate, allowing decryption of all HTTPS traffic.

Expected Outcome: Attacker can view API keys, tokens, and data in plaintext.

Blue Team (Defender)

Detection Steps:

1. Network Monitoring: Look for unusual TLS handshakes or certificate errors in logs.
2. Host-based Detection: Check for processes using rejectUnauthorized: false in Node.js applications.
3. Log Analysis: Monitor Axios error logs for certificate validation failures (though they are suppressed).

Mitigation:

• Immediately update the configuration to rejectUnauthorized: true.
• Use a proper CA bundle.
• Implement certificate pinning if possible.
• Monitor for MITM indicators (e.g., unexpected ARP replies, DNS changes).

Indicators of Compromise (IOCs)

• Network IOCs:
  • TLS connections with self-signed or untrusted certificates.
  • Unusual certificate chains or mismatched hostnames.
  • ARP spoofing patterns (duplicate IP addresses in ARP tables).
• Host IOCs:
  • Configuration files containing rejectUnauthorized: false.
  • Node.js processes with modified HTTPS agent settings.
  • Log entries showing UNABLE_TO_VERIFY_LEAF_SIGNATURE errors (if logging is enabled).
• File IOCs:
  • Hash of vulnerable file: (example) sha256:abc123... (if known).
  • File path: server/utils/axios.js or similar.

Detection Engineering

YARA Rule

rule CVE_2025_70058_YMFE_yapi {
  meta:
    description = "Detects YMFE yapi v1.12.0 with insecure rejectUnauthorized setting"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-70058"
  strings:
    $s1 = "rejectUnauthorized: false" ascii wide nocase
    $s2 = "httpsAgent" ascii wide nocase
  condition:
    all of them
}

Sigma Rule

title: CVE-2025-70058 - YMFE yapi Insecure TLS Configuration
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects YMFE yapi v1.12.0 with rejectUnauthorized set to false in Axios configuration
author: Valters IT
date: 2025-04-10
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: '/node'
    CommandLine|contains: 'rejectUnauthorized: false'
  condition: selection
falsepositives:
  - Legitimate testing environments
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (
  msg:"CVE-2025-70058 - YMFE yapi Insecure TLS Connection";
  flow:to_server,established;
  tls.cert_issuer:"CN=*";
  tls.cert_subject:"CN=*";
  tls.cert_notbefore:"*";
  tls.cert_notafter:"*";
  tls.fingerprint:"*";
  sid:1000001;
  rev:1;
)

Note: The Suricata rule is a placeholder; actual detection requires monitoring for TLS connections where certificate validation is bypassed, which is difficult at the network level. Host-based detection is more reliable.

Remediation & Mitigation

Immediate Actions:

1. Patch Configuration: Change rejectUnauthorized: false to rejectUnauthorized: true in the source code.
2. Restart Service: Restart the yapi service to apply changes.
3. Verify Certificates: Ensure the server has valid CA certificates installed (e.g., ca-certificates package on Linux).

Long-term Mitigation:

• Code Review: Audit all Axios instances for insecure settings.
• Use Environment Variables: Load TLS settings from environment variables to avoid hardcoding.
• Certificate Pinning: Implement certificate or public key pinning for critical external APIs.
• Network Segmentation: Isolate yapi servers from untrusted networks.
• Monitor for MITM: Deploy network intrusion detection systems (NIDS) to detect ARP spoofing and rogue certificates.

Workaround: If patching is not immediately possible, restrict network access to the yapi server using firewalls and only allow connections to trusted external APIs over VPN or direct connections.

Valters IT
Securing Digital Frontiers