CVE-2025-7115
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-07-08
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-7115 is a critical vulnerability in the Rowboat Labs Rowboat application where the PUT API endpoint for file uploads (located at apps/rowboat/app/api/uploads/[fileId]/route.ts) lacks proper authentication. This misconfiguration allows unauthorized users to upload files anonymously to the server. The vulnerability arises because the authentication middleware does not protect this endpoint, enabling attackers to upload arbitrary files without any verification. [1, 2, 3]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing remote attackers to upload files without authentication, potentially leading to unauthorized data being stored on your server. This can result in exhaustion of server disk space (denial-of-service), compromise of system confidentiality, integrity, and availability. Attackers could upload malicious files or large amounts of data, disrupting normal operations and possibly enabling further attacks. [1, 2, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to perform an unauthorized PUT request to the API endpoint /api/uploads/[fileId] without authentication. For example, using curl: curl -X PUT http://<target-host>/api/uploads/testfile.txt --data-binary @testfile.txt -v. If the request succeeds and the file is uploaded without authentication, the system is vulnerable. Monitoring network traffic for anonymous PUT requests to /api/uploads/ endpoints can also help detect exploitation attempts. [3]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the /api/uploads/[fileId] endpoint by enforcing authentication middleware on this route, ensuring that only authorized users can perform file uploads. If a patch or update is not yet available, consider disabling or blocking the vulnerable API endpoint entirely. Additionally, monitor and limit disk usage to prevent denial-of-service from excessive file uploads. Replacing the affected component with an alternative product until a fix is released is also recommended. [2, 3]