CVE-2025-59950
BaseFortify
Publication date: 2025-09-30
Last updated on: 2025-10-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freshrss | freshrss | to 1.27.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1021 | The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in FreshRSS (versions 1.26.3 and below) is a double clickjacking issue where an attacker can bypass the double clickjacking protection implemented via a JavaScript confirmation dialog. By exploiting a flaw in how the application handles Ajax requests with a specific URL parameter, an attacker can trick an administrator into unknowingly clicking the 'Promote' button on another user's management page. This allows the attacker to escalate their privileges to admin and access other users' accounts. The attacker must know the specific FreshRSS instance URL to carry out the attack. The issue was fixed in version 1.27.0 by disabling confirmation buttons during Ajax requests and re-enabling them only through proper client-side validation. [1, 2]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to escalate their privileges to administrator by tricking an admin into promoting them via a clickjacking attack. This means the attacker can gain full administrative access to the FreshRSS instance, including logging into other users' accounts, potentially leading to unauthorized data access, modification, or control over the system. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if your FreshRSS instance is running version 1.26.3 or below and if the user management pages respond to requests with the `&ajax=1` parameter by returning partial HTML without JavaScript confirmation dialogs. For example, you can use curl to test this behavior: `curl -i 'http://your-freshrss-instance/i/?c=user&a=details&username=someuser&ajax=1'` and verify if the response lacks the confirm() dialog JavaScript. Additionally, monitoring for suspicious admin page requests with the `&ajax=1` parameter or unusual double-click events on the Promote button could indicate exploitation attempts. [2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation is to upgrade FreshRSS to version 1.27.0 or later, where the vulnerability is fixed by disabling confirmation buttons during Ajax requests and enforcing client-side validation. If upgrading immediately is not possible, restrict access to the FreshRSS admin interface to trusted networks or users, and monitor for suspicious activity involving the Promote button. Applying stricter Content-Security-Policy headers and ensuring reauthentication (sudo mode) for sensitive actions can also help reduce risk until the update is applied. [1, 2]