CVE-2025-58443: FOGProject < 1.5.10.1693 - Authentication Bypass

id: CVE-2025-58443

info:
  name: FOGProject < 1.5.10.1693 - Authentication Bypass
  author: oleveloper
  severity: critical
  description: |
    FOGProject version 1.5.10.1673 suffers from an authentication bypass vulnerability that allows unauthenticated users to access the management interface without proper authentication. This can lead to unauthorized access to system configuration, host management, and potentially database information.
  impact: |
    Unauthenticated attackers can bypass authentication to access the FOGProject management interface and retrieve sensitive system configuration and host management information.
  remediation: |
    Upgrade FOGProject to a version later than 1.5.10.1673 that implements proper authentication on all management endpoints.
  reference:
    - https://github.com/casp3r0x0/CVE-2025-58443
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58443
    - https://github.com/FOGProject/fogproject/security/advisories/GHSA-mvwm-9m2h-87p9
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2025-58443
    epss-score: 0.21291
    epss-percentile: 0.97613
    cwe-id: CWE-287
  metadata:
    max-request: 2
    vendor: fogproject
    product: fogproject
    fofa-query: icon_hash="-1952619005"
    shodan-query: http.favicon.hash:-1952619005
  tags: cve,cve2025,fogproject,auth-bypass,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/fog/service/getversion.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - 'regex("^1\\.[56]\\.[0-9]+(\\.[0-9]+|-[a-z]+\\.[0-9]+)?$", trim_space(body))'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: fogversion
        internal: true
        regex:
          - '^1\.[56]\.[0-9.]+(-[a-z]+\.[0-9]+)?$'

  - method: GET
    path:
      - "{{BaseURL}}/fog/status/getfiles.php?path[]="

    headers:
      X-Requested-With: XMLHttpRequest

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "trim_space(body) == '\"Invalid\"'"
        condition: and

    extractors:
      - type: dsl
        dsl:
          - fogversion
# digest: 4a0a004730450220299d00a8834dcf43887a0417eb6deec1b2d9d6cfa0bfc9963786e62fa386ecc7022100f7ef44c21ebd2a1c28defa0d0e7124adb196894fe09ad085cfa6ab92d61f1ae1:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.