CVE-2025-5033
📋 TL;DR
This CSRF vulnerability in TeaCMS 2.0.2 allows attackers to trick authenticated administrators into performing unauthorized actions via the user management interface. Attackers can remotely exploit this to create new user accounts with administrative privileges. Only TeaCMS installations with the vulnerable version are affected.
💻 Affected Systems
- XiaoBingby TeaCMS
📦 What is this software?
Teacms by Teacms Project
⚠️ Risk & Real-World Impact
Worst Case
Attackers create administrative user accounts, gaining full control over the CMS to modify content, steal data, or deploy further attacks.
Likely Case
Attackers create backdoor user accounts with elevated privileges to maintain persistent access for future exploitation.
If Mitigated
With proper CSRF protections, exploitation attempts fail, preventing unauthorized user creation.
🎯 Exploit Status
Exploit details are publicly disclosed, making weaponization straightforward for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://gitee.com/xiaobingby/TeaCMS/issues/IBYRPK
Restart Required: No
Instructions:
No official patch available. Monitor vendor repository for updates and apply when released.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection to the UserManageController.addUser endpoint
Modify src/main/java/me/teacms/controller/admin/UserManageController.java to include CSRF token validation
Disable User Management Interface
allTemporarily disable the vulnerable user management functionality
Comment out or remove the addUser endpoint mapping in controller
🧯 If You Can't Patch
- Implement WAF rules to block CSRF attacks targeting the /admin/user/add endpoint
- Require re-authentication for sensitive administrative actions like user creation
🔍 How to Verify
Check if Vulnerable:
Check if TeaCMS version is 2.0.2 and if the UserManageController.addUser endpoint lacks CSRF protectionCheck Version:
Check application.properties or build files for version informationVerify Fix Applied:
Test that CSRF tokens are required for the addUser endpoint and validate they are properly checked📡 Detection & Monitoring
Log Indicators:
- Multiple user creation requests from same IP without corresponding admin login
- User creation requests missing CSRF tokens
Network Indicators:
- POST requests to /admin/user/add without Referer header validation
- CSRF attack patterns in web traffic
SIEM Query:
source="web_logs" AND uri="/admin/user/add" AND NOT csrf_token=*