CVE-2025-65681
📋 TL;DR
This vulnerability in Tutor (Open edX deployment tool) allows local unauthorized attackers to access sensitive information due to missing cache-control HTTP headers and insufficient client-side session validation. It affects Tutor installations version 20.0.2. Attackers must have local access to the system to exploit this weakness.
💻 Affected Systems
- Overhang.IO Tutor (tutor-open-edx)
- overhangio/tutor
📦 What is this software?
Tutor by Edly
⚠️ Risk & Real-World Impact
Worst Case
Local attackers could access sensitive session data, user information, or configuration details stored in cache, potentially leading to session hijacking or privilege escalation.
Likely Case
Unauthorized local users accessing cached sensitive information like session tokens or user data that should be protected.
If Mitigated
With proper cache-control headers and session validation, no information leakage occurs even to local users.
🎯 Exploit Status
Exploitation requires local access to the system. The GitHub reference shows proof-of-concept details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check latest Tutor releases (likely 20.0.3 or later)
Vendor Advisory: https://github.com/overhangio/tutor
Restart Required: Yes
Instructions:
1. Update Tutor to latest version using pip: pip install --upgrade tutor. 2. Restart all Tutor services. 3. Verify cache-control headers are properly set in responses.
🔧 Temporary Workarounds
Add Cache-Control Headers
allManually configure web server or application to add proper cache-control headers to sensitive endpoints
# Configure in web server (nginx/apache) or Tutor configuration
# Example nginx: add_header Cache-Control "no-store, no-cache, must-revalidate";
Restrict Local Access
linuxImplement strict access controls to limit who can access the Tutor instance locally
# Use firewall rules: iptables -A INPUT -s 127.0.0.1 -p tcp --dport [TUTOR_PORT] -j ACCEPT
# Then deny all other local access
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local users from accessing the Tutor instance
- Configure web server to add Cache-Control: no-store, no-cache headers to all sensitive endpoints
🔍 How to Verify
Check if Vulnerable:
Check Tutor version: tutor --version. If version is 20.0.2, check HTTP responses for missing Cache-Control headers on sensitive endpoints using curl or browser developer tools.Check Version:
tutor --versionVerify Fix Applied:
After update, verify Tutor version is >20.0.2 and check that Cache-Control headers are present in HTTP responses from sensitive endpoints.📡 Detection & Monitoring
Log Indicators:
- Unusual local access patterns to Tutor endpoints
- Multiple failed session validations from local IPs
Network Indicators:
- Local network traffic to Tutor cache endpoints without proper authentication
SIEM Query:
source="tutor.logs" AND ("cache_access" OR "session_validation_failed") AND src_ip=127.0.0.1