FACTION Unauthenticated Custom Extension Upload leads to RCE

The impact of CVE-2025-66022 is severe. An attacker can exploit this vulnerability by uploading a malicious extension through the unauthenticated /portal/AppStoreDashboard endpoint. Once uploaded, the extension's lifecycle hooks can trigger arbitrary system command execution on the server. This grants the attacker complete control over the affected system, enabling them to steal sensitive data, install malware, or pivot to other systems within the network. The lack of authentication makes this vulnerability particularly concerning, as any unauthenticated user can potentially compromise the system. This resembles the impact of other extension-based vulnerabilities where malicious code is injected and executed with elevated privileges.

Organizations utilizing FACTION for penetration testing and report generation are at risk. This includes security teams, consultants, and any environment where FACTION is deployed. Shared hosting environments where multiple users have access to the FACTION instance are particularly vulnerable, as a compromised user account could be used to exploit the vulnerability.

• linux / server: Monitor system logs (journalctl) for suspicious activity related to extension installation or execution. Look for processes spawned by the FACTION user account that are executing unusual commands.

journalctl -u faction -f | grep -i 'extension' 

• generic web: Use curl to attempt access to the /portal/AppStoreDashboard endpoint without authentication. A successful response indicates the vulnerability is present.

curl -I http://<faction_server>/portal/AppStoreDashboard

• windows / supply-chain: Examine scheduled tasks and autoruns entries for any suspicious FACTION-related tasks or startup programs.

Get-ScheduledTask | Where-Object {$_.TaskName -like '*faction*'}

1. 2025-11-26Disclosure

   disclosure

1. Réservé2025-11-21
2. Publiée2025-11-26
3. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-66022 is to immediately upgrade FACTION to version 1.7.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the /portal/AppStoreDashboard endpoint using a Web Application Firewall (WAF) or proxy to block unauthorized requests. Review existing extensions for any signs of compromise. Monitor system logs for unusual activity related to extension installation or execution. Implement strict file access controls to limit the permissions of the FACTION user account. After upgrading, confirm the fix by attempting to access the /portal/AppStoreDashboard endpoint without authentication and verifying that access is denied.