PT-2025-9537 · Openziti · Openziti

Diabl0-Sec · Published 2025-03-03 · Updated 2025-03-04 · CVE-2025-27500

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OpenZiti versions prior to 3.7.1

Description The issue concerns an endpoint, "/api/upload", on the admin panel that can be accessed without authentication. This endpoint allows file uploads via HTTP POST, which are then stored on the node and accessible via URL. If a malicious file containing code is uploaded and accessed, it can lead to a stored cross-site scripting attack when executed within the user's browser context. The function is no longer necessary and has been disabled as the ziti-console transitions from a node server application to a single-page application.

Recommendations For versions prior to 3.7.1, update to version 3.7.1 to resolve the issue. As a temporary workaround, consider disabling access to the "/api/upload" endpoint until the update is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-27500

GHSA-FRXM-VM48-5QF2

Affected Products

Openziti

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27500.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27500 · Security Note
• https://osv.dev/vulnerability/CVE-2025-27500 · Vendor Advisory
• https://github.com/openziti/ziti-console/security/advisories/GHSA-frxm-vm48-5qf2 · Note
• https://twitter.com/WolfgangSesin/status/1896890634587271266 · Twitter Post
• https://twitter.com/CVEnew/status/1896767587809149309 · Twitter Post
• https://t.me/cvedetector/19393 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1896778595575423359 · Twitter Post
• https://t.me/cvenotify/113226 · Telegram Post