CVE-2018-25361: Soroush IM Authentication Bypass Flaw

CVE-2018-25361 Overview

CVE-2018-25361 is an authentication bypass vulnerability in Soroush IM Desktop App version 0.17.0. The application stores user data in local database files protected by a passcode, but the encryption uses a constant key shared across installations. Local attackers can inject pre-encrypted database entries to remove the passcode requirement and unlock the client. Once bypassed, attackers gain access to all stored chats, images, files, and account data. The flaw is tracked under CWE-290: Authentication Bypass by Spoofing.

Critical Impact
A local attacker with file system access can bypass the application passcode and read all stored messages, media, and account data without credentials.

Affected Products

Soroush IM Desktop App 0.17.0
Windows desktop client distributions of Soroush Messenger
Installations using the default local database encryption configuration

Discovery Timeline

2026-05-25 - CVE-2018-25361 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2018-25361

Vulnerability Analysis

The Soroush IM Desktop App stores chat history, contacts, and media references in a local database file. The application protects this database by requiring a user-defined passcode at launch. The passcode logic relies on encrypted entries in the database rather than a server-side or hardware-bound check.

Because the encryption key is constant across all installations of version 0.17.0, an attacker can prepare valid encrypted records offline. Injecting those records into the target database overrides the stored passcode state. The application then treats the client as unlocked on the next launch.

This is an authentication bypass at the local trust boundary. The control protecting at-rest data is reduced to file-write access on the database.

Root Cause

The root cause is the use of a hardcoded, shared encryption key for protecting authentication state in the local database. The design assumes that an encrypted record proves legitimate prior authentication. Because any party with the constant key can produce such a record, the proof is forgeable. This pattern aligns with [CWE-290] authentication bypass through spoofed credentials.

Attack Vector

Exploitation requires local access to the file system where Soroush IM stores its database files. The attacker computes or reuses pre-encrypted database entries that represent a valid unlocked state. They write these entries into the application database, replacing or supplementing existing passcode records. On the next launch, the client accepts the injected entries and grants access without prompting for the legitimate passcode. The vulnerability mechanism is documented in Exploit-DB entry 45171 and the VulnCheck advisory.

Detection Methods for CVE-2018-25361

Indicators of Compromise

Unexpected modifications to Soroush IM database files outside normal application runtime windows
Process activity from non-Soroush binaries writing to the Soroush application data directory
Successful client launches without a corresponding passcode prompt event in user activity logs
Presence of Soroush IM Desktop 0.17.0 on managed endpoints, which is itself an exposure indicator

Detection Strategies

Inventory endpoints to identify any installation of Soroush IM Desktop App 0.17.0
Monitor file integrity on the Soroush database directory under the user profile for writes by unexpected processes
Alert on database file access patterns where read or write operations occur outside the Soroush IM process context
Correlate local logon events with subsequent database file modifications to detect post-access tampering

Monitoring Recommendations

Enable file system auditing on the Soroush application data folder and ship events to a central log platform
Track creation of unsigned helper scripts or tools targeting the Soroush install path
Review endpoint telemetry for command-line tools accessing SQLite or similar database files in the Soroush directory

How to Mitigate CVE-2018-25361

Immediate Actions Required

Uninstall Soroush IM Desktop App 0.17.0 from managed endpoints until a patched version is verified
Restrict local administrator and interactive logon rights on systems where the application is used
Treat any historical use of version 0.17.0 as a potential data exposure event and notify affected users
Remove residual database files from uninstalled instances to prevent offline data recovery

Patch Information

No vendor patch is referenced in the NVD entry or the linked advisories. Users should consult the Soroush App homepage for current releases and verify whether later versions address the constant-key issue before redeploying. Until a fixed version is confirmed, the application should not be used to handle sensitive communications.

Workarounds

Replace Soroush IM Desktop with a messaging client that uses per-user key derivation tied to the passcode
Apply full-disk encryption and strict file permissions on user profile directories to raise the cost of local database access
Limit shared or kiosk-style use of endpoints where the Soroush client is installed
Block execution of Soroush IM Desktop 0.17.0 via application control policies if removal is not immediately feasible

bash

# Example: locate and remove Soroush IM Desktop database artifacts on Windows
# Run from an administrator PowerShell session
$paths = @(
  "$env:APPDATA\Soroush",
  "$env:LOCALAPPDATA\Soroush"
)
foreach ($p in $paths) {
  if (Test-Path $p) {
    Remove-Item -Recurse -Force $p
  }
}