Executive Summary

CVE-2025-15097 is a critical authentication bypass vulnerability in Alteryx Server affecting the /gallery/api/status/ endpoint. It allows remote attackers to bypass normal authentication mechanisms without valid credentials by exploiting improper authentication handling. This means an attacker can gain unauthorized access to the server, potentially impersonating users and accessing sensitive functions. The vulnerability affects multiple versions from 2020 through 2024, with patches available starting from version 2023.1.1.13.486 and later. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to Alteryx Server, allowing attackers to bypass authentication controls and gain access to sensitive data and system functions. An attacker can obtain valid session IDs and user details, enabling them to perform privileged actions such as creating users or manipulating data. This compromises the confidentiality, integrity, and availability of the system, potentially resulting in full system compromise. [1, 2, 3]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending specific HTTP requests to the Alteryx Server API endpoints and analyzing the responses. A practical detection method involves: 1) Sending a GET request to the /api/status/ endpoint to retrieve the server version. 2) Sending a POST request to /api/auth/sessions/ with the JSON payload {"scheme":"windows","parameters":[]} to test for authentication bypass. If the server responds with a JSON object containing a valid sessionId and user details (subscriptionId, email, role), it indicates the system is vulnerable. Example commands using curl: 1) curl -X GET https://<server_address>/api/status/ 2) curl -X POST https://<server_address>/api/auth/sessions/ -H "Content-Type: application/json" -d '{"scheme":"windows","parameters":[]}' A successful response with session details confirms the vulnerability. [2]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the Alteryx Server to one of the patched versions that address this vulnerability. The fixed versions are 2023.1.1.13.486, 2023.2.1.10.293, 2024.1.1.9.236, 2024.2.1.6.125, and 2025.1.1.1.31. Upgrading to any of these versions will resolve the improper authentication issue. If upgrading immediately is not possible, consider restricting access to the affected API endpoints (/gallery/api/status/ and /api/auth/sessions/) via network controls or firewalls to limit exposure until a patch can be applied. [1, 3]

Useful 0 Not Useful 0

Compliance Impact

The provided resources do not contain information regarding the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0