CVE-2025-25595 - FULL DISCLOSURE

CVE ASSIGNED: CVE-2025-25595
CVE PUBLISHED STATE: PUBLISHED
CVE LINK: https://nvd.nist.gov/vuln/detail/CVE-2025-25595

Description:
The login page of Safe App version a3.0.9 lacks rate limiting controls, allowing attackers to perform unlimited authentication attempts via brute force attacks. This vulnerability enables potential unauthorized access to user accounts through automated password guessing.

Impact:
- Account compromise through brute force
- Unauthorized access to user data
- Escalation of privileges
- Privacy violations
- Service degradation from automated attacks

Attack Scenario:
1. Attacker targets login endpoint: https://kiwi.safe-analytics.in/account/login/?next=/
2. Login requests are captured and automated using tools like Burp Suite/Scripts
3. Multiple password attempts can be made without restriction
4. Valid credentials are eventually discovered
5. Attacker gains unauthorized account access

Technical Details:
- Vulnerability Type: Insecure Permissions
- CWE Classification: CWE-307 (Improper Restriction of Excessive Authentication Attempts)
- Attack Type: Remote
- Affected Version: a3.0.9
- Affected Component: Login API endpoint (Safe App - a3.0.9)
- Impact: Escalation of Privileges

Affected Products:
- Safe App (Android): https://play.google.com/store/apps/details?id=com.iitb.cse.arkenstone.safe_v2
- Safe Web Application: https://safe.cse.iitb.ac.in/

Vendor Information:
IIT Bombay Synergy CSE Department
https://www.cse.iitb.ac.in/synerg/

Proof of Concept:
1. Navigate to https://kiwi.safe-analytics.in/account/login/?next=/
2. Capture login request in Burp Suite
3. Configure intruder with password wordlist
4. Execute brute force attack
5. Observe unlimited login attempts allowed
6. PoC at - https://ibb.co/chmhTVQV


References:
- CVE-2023-37635
- https://nvd.nist.gov/vuln/detail/CVE-2023-37635
- https://www.esecforte.com/cve-2023-37635-login-bruteforce/

Severity: High

Fix:
- Implement rate limiting on authentication endpoints
- Add account lockout after failed attempts
- Implement CAPTCHA or similar challenge mechanisms
- Add IP-based request throttling
- Monitor and alert on brute force attempts
- Implement secure session management
- Use strong password policies
- Enable multi-factor authentication

Discoverer:
Ishwar Kumar