PT-2025-30951 · Anubis+1 · Anubis+1

Xe · Published 2025-07-26 · Updated 2025-07-29 · CVE-2025-54414

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions Anubis versions 1.21.2 and below

Description Anubis is a Web AI Firewall Utility designed to protect upstream resources from scraper bots. Attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript code or trigger other nonstandard schemes. The incomplete fix was initially tagged in version 1.21.2, but the release was aborted. The issue is addressed in version 1.21.3.

Recommendations Block any requests to the /api/pass-challenge route with the redir parameter set to anything that doesn't start with the URL scheme http, https, or no scheme (local path redirect). Update to version 1.21.3.

Exploit

Fix

Open Redirect

XSS

Weakness Enumeration

CWE-601

CWE-80

Related Identifiers

ALT-PU-2025-9752

CVE-2025-54414

GHSA-JHJJ-2G64-PX7C

Affected Products

Alt Linux

Anubis

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54414.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54414 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54414 · Vendor Advisory
• https://github.com/TecharoHQ/anubis/pull/904 · Note
• https://github.com/TecharoHQ/anubis/security/advisories/GHSA-jhjj-2g64-px7c · Note
• https://github.com/TecharoHQ/anubis/releases/tag/v1.21.3 · Note
• https://twitter.com/CVEnew/status/1948976647417294996 · Twitter Post