CVE-2025-11438
📋 TL;DR
This CVE describes a missing authorization vulnerability in JhumanJ OpnForm's API endpoint at /custom-domains. Attackers can exploit this to perform unauthorized actions on custom domain configurations. All OpnForm instances up to version 1.9.3 are affected.
💻 Affected Systems
- JhumanJ OpnForm
📦 What is this software?
Opnform by Jhumanj
⚠️ Risk & Real-World Impact
Worst Case
Attackers could modify or delete custom domain configurations, potentially redirecting legitimate traffic to malicious sites or disrupting service availability.
Likely Case
Unauthorized users could view or modify custom domain settings, potentially causing service disruption or configuration changes.
If Mitigated
With proper authorization controls, only authenticated administrators could access custom domain management functions.
🎯 Exploit Status
Exploit details have been publicly disclosed but no proof-of-concept code is confirmed. Attack requires understanding of API structure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after commit beb153ce52dceb971c1518f98333328c95f1ba20
Vendor Advisory: https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20
Restart Required: No
Instructions:
1. Update OpnForm to version after commit beb153ce52dceb971c1518f98333328c95f1ba20. 2. Verify the patch is applied by checking the commit hash in your deployment.
🔧 Temporary Workarounds
API Endpoint Restriction
allRestrict access to the /custom-domains API endpoint using network controls or web application firewall rules.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate OpnForm instances from untrusted networks.
- Deploy a web application firewall with rules to block unauthorized access to /custom-domains endpoint.
🔍 How to Verify
Check if Vulnerable:
Check if your OpnForm version is 1.9.3 or earlier and if the /custom-domains endpoint is accessible without proper authorization.Check Version:
Check OpnForm version in application settings or deployment configuration files.Verify Fix Applied:
Verify that commit beb153ce52dceb971c1518f98333328c95f1ba20 is present in your deployment and test that /custom-domains endpoint requires proper authorization.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to /custom-domains endpoint
- Unexpected modifications to custom domain configurations
Network Indicators:
- Unusual API calls to /custom-domains from unauthorized IP addresses
SIEM Query:
source="opnform" AND (uri="/custom-domains" OR uri="/api/custom-domains") AND (response_code=401 OR response_code=403)🔗 References
- https://docs.google.com/document/d/1GUjJA9vUbsXUngAv6ySsbCIhVynf8_djardLZYEDOe0/edit?tab=t.0#heading=h.gm61tyll8uys
- https://github.com/JhumanJ/OpnForm/pull/900/commits/beb153ce52dceb971c1518f98333328c95f1ba20
- https://vuldb.com/?ctiid.327375
- https://vuldb.com/?id.327375
- https://vuldb.com/?submit.666879
