CVE-2025-15099
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication in simstudioai sim by manipulating the INTERNAL_API_SECRET argument in the CRON Secret Handler component. Attackers can potentially execute unauthorized actions or access restricted functionality. All users running affected versions of simstudioai sim are impacted.
💻 Affected Systems
- simstudioai sim
📦 What is this software?
Sim by Sim
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing unauthorized execution of CRON jobs, data exfiltration, or privilege escalation within the application.
Likely Case
Unauthorized access to internal APIs, manipulation of scheduled tasks, or disruption of application functionality.
If Mitigated
Limited impact if proper network segmentation and authentication controls are already in place.
🎯 Exploit Status
Public exploit available on GitHub gist with reproduction steps
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.5.28 or later
Vendor Advisory: https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a
Restart Required: Yes
Instructions:
1. Update to version 0.5.28 or later. 2. Apply commit e359dc2946b12ed5e45a0ec9c95ecf91bd18502a. 3. Restart the application service.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to the CRON Secret Handler endpoint
iptables -A INPUT -p tcp --dport [PORT] -s [TRUSTED_IPS] -j ACCEPT
iptables -A INPUT -p tcp --dport [PORT] -j DROP
Secret Rotation
allRotate INTERNAL_API_SECRET to a strong, random value
export INTERNAL_API_SECRET=$(openssl rand -hex 32)
🧯 If You Can't Patch
- Implement strict network ACLs to limit access to the vulnerable endpoint
- Monitor logs for authentication bypass attempts and unauthorized CRON executions
🔍 How to Verify
Check if Vulnerable:
Check if version is <=0.5.27 and examine apps/sim/lib/auth/internal.ts for the vulnerable codeCheck Version:
npm list simstudioai-sim | grep simstudioai-simVerify Fix Applied:
Verify version is >=0.5.28 or that commit e359dc2946b12ed5e45a0ec9c95ecf91bd18502a is applied📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts with manipulated INTERNAL_API_SECRET
- Unauthorized CRON job executions
- Access to restricted endpoints without proper auth
Network Indicators:
- Unusual traffic to CRON handler endpoints
- Requests with malformed authentication headers
SIEM Query:
source="application.log" AND ("INTERNAL_API_SECRET" OR "auth bypass" OR "CRON Secret Handler")🔗 References
- https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2
- https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce
- https://github.com/simstudioai/sim/commit/e359dc2946b12ed5e45a0ec9c95ecf91bd18502a
- https://github.com/simstudioai/sim/pull/2343
- https://vuldb.com/?ctiid.338430
- https://vuldb.com/?id.338430
- https://vuldb.com/?submit.710255
- https://gist.github.com/H2u8s/c533741e1b36f6245d41cace89a7f4d2#-steps-to-reproduce
