Tuleap carece de protecciones CSRF para su API de gestión de planificación

Successful exploitation of CVE-2025-64499 allows an attacker to execute arbitrary actions within the Tuleap environment through a victim's authenticated session. Specifically, they can create, edit, or delete plans, potentially disrupting workflows, introducing malicious configurations, or gaining unauthorized access to sensitive data related to software development and collaboration. The blast radius extends to any user with access to the planning management API, and a compromised plan could impact multiple projects and teams. While the vulnerability doesn't directly lead to system compromise, it can be a stepping stone for further attacks if combined with other vulnerabilities or misconfigurations.

Organizations heavily reliant on Tuleap for software development and collaboration management are at risk, particularly those running older versions of Tuleap Enterprise Edition. Shared hosting environments where multiple users share the same Tuleap instance are also at increased risk, as a compromised user account could be used to exploit the vulnerability and impact other users.

• php: Examine Tuleap application logs for suspicious requests related to the planning management API, particularly those originating from unexpected IP addresses or user agents.

grep -i 'planning management api' /var/log/apache2/access.log

• generic web: Monitor Tuleap's web application firewall (WAF) logs for CSRF attack patterns, such as requests with unexpected referer headers or unusual request parameters. • generic web: Check response headers for the presence of CSRF protection tokens. Absence of these tokens could indicate a misconfiguration or lack of protection. • generic web: Use a web proxy to intercept and analyze HTTP requests to the planning management API, looking for suspicious parameters or actions.

1. 2025-12-08Disclosure

   disclosure

1. Reservado2025-11-05
2. Publicada2025-12-08
3. Modificada2025-12-09
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-64499 is to upgrade Tuleap Enterprise Edition to version 16.13.1 or later, or to version 16.12-10 or 17.0-2. If an immediate upgrade is not feasible, consider implementing stricter input validation and output encoding on the planning management API to reduce the attack surface. Implementing CSRF protection mechanisms, such as synchronizer tokens or double-submit cookies, can also help mitigate the risk. Review and restrict access to the planning management API to only authorized users. After upgrading, confirm the fix by attempting to trigger a plan creation/modification request from a separate browser session without valid credentials; the request should be rejected.