CVE-2025-0403: Reggie Information Disclosure Vulnerability

CVE-2025-0403 Overview

CVE-2025-0403 is an information disclosure vulnerability in 1902756969 reggie version 1.0. The flaw resides in the /user/sendMsg endpoint, which is part of the Phone Number Validation Handler component. Attackers can manipulate the code argument to trigger unintended disclosure of sensitive information. The vulnerability is remotely exploitable over the network without authentication or user interaction. Public disclosure of the exploit details increases the risk of opportunistic abuse against exposed instances. The weakness maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Remote, unauthenticated attackers can retrieve phone verification codes from the /user/sendMsg endpoint, enabling account takeover through SMS one-time password interception.

Affected Products

1902756969 reggie 1.0
Deployments exposing the /user/sendMsg endpoint
Applications relying on the Phone Number Validation Handler component

Discovery Timeline

2025-01-13 - CVE-2025-0403 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0403

Vulnerability Analysis

The vulnerability affects the Phone Number Validation Handler in the reggie application. When a client submits a request to /user/sendMsg, the server processes the code parameter in a way that exposes the verification code to the requester. This behavior turns the SMS verification workflow into an oracle for attackers. Because reggie is commonly used as a food-ordering training project, deployed instances often reach production with default configurations. The disclosure allows attackers to bypass phone-based verification and impersonate legitimate users during registration or login flows.

Root Cause

The root cause is improper output handling in the phone verification workflow. The sendMsg handler returns or logs the generated verification code on the response path rather than storing it server-side and comparing it against user input. This design decision violates the principle that authentication secrets must never traverse untrusted boundaries. See CWE-200 for background on information exposure weaknesses.

Attack Vector

An unauthenticated attacker sends an HTTP request to the /user/sendMsg endpoint with a target phone number. The server responds with, or otherwise exposes, the verification code intended to be delivered only via SMS. The attacker then submits the code to the login or registration endpoint to complete authentication. No privileges, tokens, or user interaction are required. Refer to the GitHub Issue Discussion and VulDB #291278 for further technical context.

Detection Methods for CVE-2025-0403

Indicators of Compromise

Repeated unauthenticated HTTP requests to /user/sendMsg from a single source IP within short time windows
Successful logins immediately following bursts of sendMsg calls for the same phone number
Unusual volume of SMS verification requests targeting sequential or enumerated phone numbers
Web server logs showing 200 responses to /user/sendMsg containing numeric code values in the response body

Detection Strategies

Monitor application logs for anomalous request patterns against the /user/sendMsg endpoint
Inspect HTTP responses for numeric OTP-like values returned from verification endpoints
Correlate sendMsg traffic with subsequent authentication events using shared identifiers
Deploy web application firewall (WAF) rules that flag repeated calls to phone verification endpoints from the same origin

Monitoring Recommendations

Centralize application and reverse proxy logs into a SIEM for correlation across the authentication pipeline
Alert on any endpoint response containing values matching the verification code format
Track baseline request rates for /user/sendMsg and alert on deviations exceeding standard thresholds
Review outbound SMS gateway metrics for spikes that do not correlate with legitimate user registrations

How to Mitigate CVE-2025-0403

Immediate Actions Required

Restrict public exposure of the reggie application until a fix is applied
Rate-limit the /user/sendMsg endpoint per source IP and per target phone number
Audit application source code to remove any response paths that return verification codes to clients
Invalidate previously issued verification codes and force reissuance through a secure channel

Patch Information

No official vendor patch has been published for CVE-2025-0403 at the time of writing. The project is maintained on GitHub; consult the GitHub Issue Discussion for remediation guidance from the maintainer and community. Organizations running reggie 1.0 should apply source-level changes to ensure verification codes are stored server-side and compared against user submissions, never returned in HTTP responses.

Workarounds

Place the application behind a reverse proxy that strips or blocks responses containing verification codes
Implement server-side session storage for verification codes and remove all client-visible return paths
Enforce CAPTCHA or proof-of-work on the /user/sendMsg endpoint to slow automated enumeration
Isolate reggie deployments from production authentication systems until code is remediated

bash

# Example nginx configuration to rate-limit the vulnerable endpoint
limit_req_zone $binary_remote_addr zone=sendmsg:10m rate=5r/m;

location /user/sendMsg {
    limit_req zone=sendmsg burst=2 nodelay;
    proxy_pass http://reggie_backend;
}