CVE-2025-65112
📋 TL;DR
PubNet versions before 1.1.3 allow unauthenticated attackers to upload packages as any user by manipulating the author-id parameter in the /api/storage/upload endpoint. This enables identity spoofing, privilege escalation, and supply chain compromise. Anyone running a vulnerable PubNet instance is affected.
💻 Affected Systems
- PubNet
📦 What is this software?
Pubnet by Ricardoboss
⚠️ Risk & Real-World Impact
Worst Case
Attackers upload malicious packages under legitimate author names, poisoning the package repository and compromising all downstream users who install these packages.
Likely Case
Attackers upload packages with backdoors or malware under trusted author identities, leading to supply chain attacks against developers using the compromised repository.
If Mitigated
If proper authentication and authorization controls are in place, only legitimate users can upload packages under their own identities.
🎯 Exploit Status
Exploitation requires only HTTP POST requests with manipulated author-id parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.3
Vendor Advisory: https://github.com/ricardoboss/PubNet/security/advisories/GHSA-pg82-fqrg-q6j5
Restart Required: Yes
Instructions:
1. Stop PubNet service. 2. Update to version 1.1.3 via package manager or manual installation. 3. Restart PubNet service.
🔧 Temporary Workarounds
Block Unauthenticated Uploads
allConfigure web server or firewall to block unauthenticated access to /api/storage/upload endpoint
Disable Upload Endpoint
allTemporarily disable package upload functionality until patching
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PubNet instance from untrusted networks
- Deploy WAF rules to block requests with manipulated author-id parameters
🔍 How to Verify
Check if Vulnerable:
Check if PubNet version is below 1.1.3 and if /api/storage/upload endpoint accepts requests with arbitrary author-id values without authenticationCheck Version:
pubnet --version or check package managerVerify Fix Applied:
Verify version is 1.1.3 or higher and test that /api/storage/upload endpoint rejects unauthenticated requests with arbitrary author-id values📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /api/storage/upload with unusual author-id values
- Uploads from unexpected IP addresses
Network Indicators:
- Unusual traffic patterns to upload endpoint
- Packages uploaded with mismatched author metadata
SIEM Query:
source="pubnet" AND path="/api/storage/upload" AND status=200 AND NOT user_agent="legitimate-client"