CVE-2025-65278
📋 TL;DR
An unauthenticated information disclosure vulnerability in GroceryMart's users.json file exposes plaintext credentials. Attackers can access usernames and passwords without authentication. This affects GroceryMart deployments using the vulnerable commit.
💻 Affected Systems
- GroceryMart
📦 What is this software?
Grocerymart by Komal97
⚠️ Risk & Real-World Impact
Worst Case
Complete credential compromise leading to account takeover, data theft, and lateral movement within the system.
Likely Case
Credential harvesting enabling unauthorized access to user accounts and potential data exposure.
If Mitigated
Limited impact if proper access controls and credential rotation are implemented.
🎯 Exploit Status
The GitHub gist demonstrates the vulnerability. Exploitation requires direct access to the users.json file path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None provided
Restart Required: No
Instructions:
1. Check for updated GroceryMart versions. 2. If no patch exists, implement workarounds. 3. Remove or secure the users.json file.
🔧 Temporary Workarounds
Restrict File Access
linuxSet proper file permissions to prevent unauthorized access to users.json
chmod 600 users.json
chown root:root users.json
Web Server Configuration
allBlock access to sensitive files via web server configuration
location ~* \.json$ { deny all; }
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the GroceryMart instance
- Enable strong authentication mechanisms and rotate all exposed credentials immediately
🔍 How to Verify
Check if Vulnerable:
Attempt to access /path/to/users.json from an unauthenticated session. If the file returns user data, the system is vulnerable.Check Version:
Check GroceryMart commit hash or version file if availableVerify Fix Applied:
Verify that accessing users.json returns a 403/404 error or requires authentication.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to users.json file
- Multiple failed authentication attempts followed by successful logins
Network Indicators:
- HTTP GET requests to users.json from unauthorized IPs
- Unusual outbound traffic after accessing the file
SIEM Query:
source="web_server" AND (uri="*users.json" OR uri="*.json") AND status=200