CVE-2025-1358: Pix Software Vivaz CSRF Vulnerability

CVE-2025-1358 Overview

CVE-2025-1358 is a Cross-Site Request Forgery (CSRF) vulnerability affecting Pix Software Vivaz version 6.0.10. The flaw resides in an unspecified code path within the application and allows remote attackers to trick authenticated users into submitting unintended state-changing requests. The exploit details have been publicly disclosed, increasing the likelihood of opportunistic abuse. The vendor was contacted prior to public disclosure but did not respond. The weakness is classified under CWE-352: Cross-Site Request Forgery and requires user interaction over the network for successful exploitation.

Critical Impact
Remote attackers can coerce authenticated users into performing unauthorized actions within Pix Software Vivaz 6.0.10, potentially altering application data without user consent.

Affected Products

Pix Software Vivaz 6.0.10

Discovery Timeline

2025-02-16 - CVE-2025-1358 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1358

Vulnerability Analysis

The vulnerability in Pix Software Vivaz 6.0.10 stems from the absence of anti-CSRF protections on state-changing HTTP requests. An attacker who convinces an authenticated user to visit a malicious page or click a crafted link can cause the user's browser to submit forged requests to the application. Because the application trusts the session cookie without validating an origin token or referrer, the forged request executes with the victim's privileges.

Exploitation requires user interaction, such as loading an attacker-controlled page, but does not require credentials or elevated privileges on the attacker's side. The scope of impact depends on which functionality the targeted user can access within the Vivaz application. Public disclosure of the technique lowers the barrier for reuse by opportunistic threat actors.

Root Cause

The root cause is missing or insufficient enforcement of unpredictable per-request tokens on sensitive endpoints. Without a synchronizer token, double-submit cookie, or SameSite cookie enforcement, the application cannot distinguish legitimate requests from forged cross-origin requests. This maps directly to CWE-352.

Attack Vector

The attack vector is network-based and requires user interaction. A typical exploitation flow involves hosting an HTML page containing an auto-submitting form or an image tag targeting a Vivaz endpoint. When an authenticated Vivaz user loads the attacker's page, the browser attaches session cookies and performs the state-changing action. No authentication bypass or credential theft is required. Technical details are indexed at VulDB entry #295966.

Detection Methods for CVE-2025-1358

Indicators of Compromise

Unexpected state-changing HTTP requests to Vivaz endpoints originating from external Referer or Origin headers.
Application audit logs showing actions performed by users during sessions that did not include direct navigation to the affected function.
Web server logs showing POST requests without a corresponding prior GET to load the form page.

Detection Strategies

Inspect HTTP request headers for mismatches between Origin, Referer, and the application's canonical hostname on state-changing routes.
Correlate user session activity with browser history and expected workflows to identify anomalous actions.
Deploy a web application firewall rule that flags POST or PUT requests to Vivaz endpoints lacking a valid anti-CSRF token.

Monitoring Recommendations

Enable verbose application logging for authenticated user actions, capturing source IP, User-Agent, and referrer.
Alert on repeated failed or unusual requests targeting administrative or configuration endpoints.
Review VulDB CTI ID #295966 for updated threat intelligence associated with this CVE.

How to Mitigate CVE-2025-1358

Immediate Actions Required

Restrict access to the Vivaz application to trusted networks or VPN-only reachability until a vendor patch is available.
Instruct users to log out of the Vivaz application when not in active use, minimizing the window for CSRF exploitation.
Warn users against clicking unsolicited links or opening untrusted browser tabs while authenticated to Vivaz.

Patch Information

No vendor patch has been published. According to the disclosure, the vendor did not respond to notification. Consult the VulDB submission record #496141 for the latest status and any subsequent vendor communication.

Workarounds

Configure browsers or enterprise policy to enforce SameSite=Lax or SameSite=Strict behavior on session cookies where possible.
Deploy a reverse proxy or WAF rule that rejects state-changing requests missing a valid Origin or Referer header matching the Vivaz hostname.
Segment Vivaz users into a dedicated browser profile to prevent cookies from being available during general web browsing.

bash

# Example nginx rule rejecting cross-origin POST requests to Vivaz
location / {
    if ($request_method = POST) {
        set $csrf_check "";
        if ($http_origin !~* "^https?://vivaz\.internal\.example\.com") {
            set $csrf_check "deny";
        }
        if ($csrf_check = "deny") {
            return 403;
        }
    }
    proxy_pass http://vivaz_backend;
}