CVE-2025-6533
📋 TL;DR
This vulnerability allows attackers to bypass authentication in novel-plus by replaying CAPTCHA tokens, potentially gaining unauthorized access to administrative functions. It affects novel-plus versions up to 5.1.3. The attack requires remote access but has high complexity.
💻 Affected Systems
- xxyopen/201206030 novel-plus
📦 What is this software?
Novel Plus by Xxyopen
⚠️ Risk & Real-World Impact
Worst Case
Complete administrative takeover of the novel-plus application, allowing attackers to modify content, access user data, or deploy further attacks.
Likely Case
Unauthorized access to administrative functions, potentially leading to data exposure or content manipulation.
If Mitigated
Limited impact with proper network segmentation and monitoring, though authentication bypass remains possible.
🎯 Exploit Status
Exploit disclosed publicly but requires specific timing and understanding of CAPTCHA replay attacks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a version above 5.1.3 if released, or implement workarounds.
🔧 Temporary Workarounds
Implement CAPTCHA Token Expiry
allModify the CAPTCHA handler to enforce short-lived tokens (e.g., 30 seconds) and prevent reuse.
Modify novel-admin/src/main/java/com/java2nb/system/controller/LoginController.java to add timestamp validation for CAPTCHA tokens.
Rate Limit Login Attempts
allImplement IP-based rate limiting on login endpoints to reduce brute-force effectiveness.
Configure web server (e.g., nginx, Apache) or application firewall to limit requests to /ajaxLogin endpoint.
🧯 If You Can't Patch
- Restrict access to the novel-plus admin interface using network ACLs or VPNs.
- Monitor authentication logs for unusual login patterns or CAPTCHA bypass attempts.
🔍 How to Verify
Check if Vulnerable:
Check if novel-plus version is 5.1.3 or earlier by reviewing application configuration or version files.Check Version:
Check application configuration files or database for version information; no standard command available.Verify Fix Applied:
Test login functionality to ensure CAPTCHA tokens cannot be replayed and expire as expected.📡 Detection & Monitoring
Log Indicators:
- Multiple failed login attempts with reused CAPTCHA tokens
- Successful logins from unusual IPs after CAPTCHA bypass
Network Indicators:
- Unusual traffic patterns to /ajaxLogin endpoint
- Rapid authentication requests
SIEM Query:
source="novel-plus" AND (event="login_failure" AND captcha_token_reused="true") OR (event="login_success" AND ip NOT IN trusted_ips)🔗 References
- https://blog.0xd00.com/blog/captcha-replay-attack-lead-to-brute-force-protection-bypass
- https://blog.0xd00.com/blog/captcha-replay-attack-lead-to-brute-force-protection-bypass#poc
- https://vuldb.com/?ctiid.313652
- https://vuldb.com/?id.313652
- https://vuldb.com/?submit.596481
- https://blog.0xd00.com/blog/captcha-replay-attack-lead-to-brute-force-protection-bypass
