CVE-2025-64497
📋 TL;DR
This CVE describes an authorization bypass vulnerability in Tuleap's file release system. Attackers can access file release information in projects they shouldn't have permission to view. This affects all Tuleap Community Edition versions below 17.0.99.1762431347 and Enterprise Edition versions below 17.0-2, 16.13-7, and 16.12-10.
💻 Affected Systems
- Tuleap Community Edition
- Tuleap Enterprise Edition
📦 What is this software?
Tuleap by Enalean
Tuleap by Enalean
Tuleap by Enalean
Tuleap by Enalean
⚠️ Risk & Real-World Impact
Worst Case
Sensitive project information, release artifacts, or proprietary software packages could be exfiltrated by unauthorized users, leading to intellectual property theft or competitive advantage loss.
Likely Case
Unauthorized users gain visibility into project release schedules, version information, and potentially access to released files they shouldn't see, compromising project confidentiality.
If Mitigated
With proper network segmentation and access controls, impact is limited to information disclosure within the Tuleap instance, though sensitive data could still be exposed.
🎯 Exploit Status
Exploitation requires some level of access to the Tuleap instance but bypasses project-level authorization checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Community Edition: 17.0.99.1762431347; Enterprise Edition: 17.0-2, 16.13-7, 16.12-10
Vendor Advisory: https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v
Restart Required: Yes
Instructions:
1. Backup your Tuleap instance and database. 2. Update to the patched version using your distribution's package manager or Tuleap upgrade process. 3. Restart Tuleap services. 4. Verify the fix by testing file release access controls.
🔧 Temporary Workarounds
Disable File Release System
allTemporarily disable the file release functionality to prevent exploitation while planning upgrade.
# Requires Tuleap admin access and configuration changes
Restrict Network Access
linuxLimit access to Tuleap instance to trusted users only while vulnerable.
# Use firewall rules to restrict access to Tuleap ports
🧯 If You Can't Patch
- Implement strict network segmentation to limit Tuleap access to authorized users only
- Monitor file release system access logs for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check Tuleap version via admin interface or by examining installed packages. Test if users can access file releases in projects they don't have permission for.Check Version:
On Tuleap server: rpm -qa | grep tuleap OR dpkg -l | grep tuleap OR check Tuleap admin interfaceVerify Fix Applied:
After patching, verify version is updated and test that unauthorized users cannot access file release information in restricted projects.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to file release endpoints
- Access to /plugins/frs/ URLs from unauthorized users
Network Indicators:
- Unusual patterns of file release system access
- Requests to file release API endpoints from unauthorized IPs
SIEM Query:
source="tuleap.log" AND (uri_path="/plugins/frs/*" OR message="*file release*access*denied*")🔗 References
- https://github.com/Enalean/tuleap/commit/403eb69f4cfafe52254c8f9bdbe66e1fedadc254
- https://github.com/Enalean/tuleap/security/advisories/GHSA-v6vm-6rxf-7p2v
- https://tuleap.net/plugins/git/tuleap/tuleap/stable?a=commit&h=403eb69f4cfafe52254c8f9bdbe66e1fedadc254
- https://tuleap.net/plugins/tracker/?aid=45583
