CVE-2025-50179
📋 TL;DR
This CVE describes a cross-site request forgery (CSRF) vulnerability in Tuleap that allows attackers to trick authenticated users into modifying canned responses. The vulnerability affects Tuleap Community Edition prior to version 16.8.99.1749830289 and Tuleap Enterprise Edition prior to version 16.9-1. Attackers can exploit this by getting victims to visit malicious web pages while logged into Tuleap.
💻 Affected Systems
- Tuleap Community Edition
- Tuleap Enterprise Edition
📦 What is this software?
Tuleap by Enalean
Tuleap by Enalean
⚠️ Risk & Real-World Impact
Worst Case
An attacker could modify all canned responses in the system, potentially altering standard communication templates, inserting malicious content, or disrupting workflow processes.
Likely Case
Attackers modify specific canned responses to insert phishing links, malicious instructions, or inappropriate content that gets distributed through normal Tuleap workflows.
If Mitigated
With proper CSRF protections and user awareness training, the impact is limited to minor content modifications that can be quickly detected and reverted.
🎯 Exploit Status
Exploitation requires the victim to be authenticated to Tuleap and visit a malicious webpage. The attack leverages standard CSRF techniques without requiring special privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition: 16.8.99.1749830289, Enterprise Edition: 16.9-1
Vendor Advisory: https://github.com/Enalean/tuleap/security/advisories/GHSA-rxpm-g7gw-4mrv
Restart Required: Yes
Instructions:
1. Backup your Tuleap instance and database. 2. Update Tuleap using your package manager (apt/yum). 3. Run 'tuleap-cfg site-deploy' to apply changes. 4. Restart Tuleap services. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
CSRF Token Validation
allImplement custom CSRF token validation for canned response modifications if immediate patching isn't possible.
# Requires custom plugin development - no simple command
Restrict Canned Response Access
allLimit which users can modify canned responses to reduce attack surface.
# Configure through Tuleap web interface: Admin > Permissions
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to detect and block CSRF attempts targeting canned response endpoints
- Educate users about CSRF risks and advise them to log out of Tuleap when browsing untrusted websites
🔍 How to Verify
Check if Vulnerable:
Check Tuleap version via web interface (Admin > System Info) or command line: 'tuleap version'Check Version:
tuleap versionVerify Fix Applied:
Verify version is at least Community Edition 16.8.99.1749830289 or Enterprise Edition 16.9-1, then test canned response modification with CSRF testing tools📡 Detection & Monitoring
Log Indicators:
- Multiple canned response modifications from same user in short timeframe
- Canned response modifications from unexpected user agents or IP addresses
Network Indicators:
- HTTP POST requests to /plugins/tracker_canned_response/ endpoints without proper Referer headers
- Requests with missing or invalid CSRF tokens
SIEM Query:
source="tuleap" AND (uri_path="/plugins/tracker_canned_response/" AND http_method="POST") | stats count by src_ip, user🔗 References
- https://github.com/Enalean/tuleap/commit/0f9aab6e3640e892c74c9dfc90ad65fd3aff499e
- https://github.com/Enalean/tuleap/security/advisories/GHSA-rxpm-g7gw-4mrv
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=0f9aab6e3640e892c74c9dfc90ad65fd3aff499e
- https://tuleap.net/plugins/tracker/?aid=43357
