CVE-2025-60645
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in xxl-api v1.3.0 allows attackers to trick authenticated administrators into executing unauthorized actions. Attackers can add arbitrary users to the management module via crafted GET requests. This affects any deployment of xxl-api v1.3.0 with the management module accessible.
💻 Affected Systems
- xxl-api
📦 What is this software?
Xxl Api by Xuxueli
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative access by adding themselves as users, leading to complete system compromise, data theft, or further privilege escalation.
Likely Case
Unauthorized users are added to the system with administrative privileges, enabling data access, configuration changes, or lateral movement.
If Mitigated
With proper CSRF protections, the attack fails, maintaining system integrity and preventing unauthorized user creation.
🎯 Exploit Status
Exploitation requires the victim to be authenticated as an administrator and visit a malicious page. The proof-of-concept is publicly available in the GitHub issue.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: https://github.com/xuxueli/xxl-api/issues/64
Restart Required: No
Instructions:
No official patch is available. Apply workarounds or upgrade to a newer version if one becomes available.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to all state-changing requests in the management module.
Modify source code to include CSRF tokens in forms and validate them on the server.
Restrict Management Module Access
allLimit access to the management module to trusted IP addresses or networks.
Configure web server (e.g., Apache, Nginx) to restrict access via IP whitelisting.
🧯 If You Can't Patch
- Monitor for unauthorized user creation in logs and alert on suspicious activity.
- Implement strong authentication and session management to reduce the window of opportunity for CSRF attacks.
🔍 How to Verify
Check if Vulnerable:
Check if running xxl-api v1.3.0 and if the management module is accessible without CSRF protection.Check Version:
Check the application version in the web interface or configuration files.Verify Fix Applied:
Test that CSRF tokens are required for user addition requests and that unauthorized requests are rejected.📡 Detection & Monitoring
Log Indicators:
- Log entries showing user creation from unexpected IP addresses or without proper authentication context.
Network Indicators:
- HTTP GET requests to user addition endpoints without CSRF tokens.
SIEM Query:
source="web_logs" AND (uri="/api/user/add" OR uri CONTAINS "addUser") AND method="GET"