CVE-2025-56333
Privilege Escalation via 2FA in Fossorial fosrl/pangolin
Publication date: 2025-12-29
Last updated on: 2025-12-29
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| fossorial | pangolin | 1.6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Fossorial fosrl/pangolin version 1.6.2 and earlier, where a remote attacker can escalate privileges by exploiting the two-factor authentication (2FA) component.
How can this vulnerability impact me? :
The vulnerability allows a remote attacker to gain higher privileges than intended, potentially compromising system security and allowing unauthorized access or control.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to bypass PIN authentication and two-factor authentication (2FA) protections by brute-forcing 6-digit PINs and TOTPs due to insufficient rate limiting. This unauthorized access risk could lead to exposure of sensitive personal or protected health information, potentially resulting in non-compliance with standards like GDPR and HIPAA that require strong access controls and protection of sensitive data. Therefore, the vulnerability negatively impacts compliance by undermining authentication security measures critical for protecting regulated data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring and analyzing traffic to the vulnerable endpoints, specifically looking for unusually high rates of authentication attempts to the /resource/:resourceId/pincode and /login endpoints. Since the vulnerability involves brute-force attacks exploiting insufficient rate limiting, commands to detect it could include using network monitoring tools or logs to identify rapid repeated requests to these endpoints. For example, using tools like tcpdump or tshark to filter HTTP requests to these paths, or analyzing web server logs for high-frequency POST requests to /resource/*/pincode and /login. Specific commands might be: 1) tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' | grep -E '/resource/.*/pincode|/login' 2) grep -E '/resource/.*/pincode|/login' /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -nr to find IPs with high request counts. These approaches help identify potential brute-force attempts exploiting the vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include configuring dedicated authentication-specific rate limiting parameters for the vulnerable endpoints (/resource/:resourceId/pincode and /login) to restrict the number of authentication attempts per IP and path to a much lower threshold than the global limit. This prevents brute-force attacks by limiting attempts to guess 6-digit PINs or TOTPs. Additionally, implementing IP-based blocking or blacklisting for suspicious repeated failed attempts, enabling multi-factor authentication methods beyond 6-digit TOTPs, and updating to fosrl/pangolin version 1.7.0 or later where this issue is remediated are recommended. If updating immediately is not possible, applying custom middleware or firewall rules to enforce stricter rate limits on these endpoints can help reduce risk. [1]