CVE-2025-14197: Verysync Information Disclosure Flaw

CVE-2025-14197 Overview

CVE-2025-14197 is an information disclosure vulnerability in Verysync 微力同步 up to version 2.21.3. The flaw resides in an unknown function within the file /rest/f/api/resources/f96956469e7be39d, part of the Web Administration Module. Attackers can exploit this weakness remotely without authentication or user interaction to disclose sensitive information. The exploit has been publicly disclosed and may be used in the wild. The vendor was contacted about the disclosure but did not respond. The weakness is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive information from vulnerable Verysync deployments through the Web Administration Module.

Affected Products

Verysync 微力同步 versions up to and including 2.21.3
Component: Web Administration Module
Endpoint: /rest/f/api/resources/f96956469e7be39d

Discovery Timeline

2025-12-07 - CVE-2025-14197 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14197

Vulnerability Analysis

The vulnerability affects the Web Administration Module of Verysync 微力同步, a file synchronization application. An unknown function tied to the REST endpoint /rest/f/api/resources/f96956469e7be39d mishandles resource access, permitting an unauthenticated remote client to retrieve sensitive data. Because the attack vector is network-based and requires no privileges or user interaction, adversaries can probe exposed instances directly over HTTP. Public disclosure of the exploit details increases the likelihood of opportunistic scanning against internet-facing Verysync installations.

Root Cause

The root cause maps to [CWE-200], the exposure of sensitive information to an unauthorized actor. The /rest/f/api/resources/ handler returns resource data without enforcing sufficient authentication or authorization checks. As a result, the API responds to unauthenticated requests with content that should be restricted to administrative users. Insufficient access control on internal REST resources is a recurring pattern in web administration components that expose backend state.

Attack Vector

An attacker locates a reachable Verysync Web Administration Module on the target network. The attacker issues an HTTP request to the vulnerable endpoint /rest/f/api/resources/f96956469e7be39d without credentials. The server returns sensitive resource data in the response body, which the attacker uses for reconnaissance or follow-on attacks. No user interaction is required. Technical details are referenced in GitHub Issue #6, GitHub Issue #8, and VulDB entry #334617.

Detection Methods for CVE-2025-14197

Indicators of Compromise

Unauthenticated HTTP GET requests to /rest/f/api/resources/f96956469e7be39d in Verysync web server logs
HTTP 200 responses to the vulnerable endpoint from external or untrusted IP addresses
Repeated resource enumeration attempts against /rest/f/api/ paths from a single source

Detection Strategies

Inspect Verysync access logs for requests to the affected REST path originating from outside the administrative network segment
Deploy network intrusion detection signatures that flag HTTP requests to /rest/f/api/resources/ without a valid session cookie or authorization header
Correlate anomalous outbound data volumes from Verysync hosts with incoming requests to the Web Administration Module

Monitoring Recommendations

Enable verbose access logging on the Verysync Web Administration Module and forward logs to a centralized SIEM
Alert on any access to administrative REST endpoints from IPs outside a defined management allowlist
Track unauthenticated request patterns targeting file synchronization services exposed to the internet

How to Mitigate CVE-2025-14197

Immediate Actions Required

Restrict network access to the Verysync Web Administration Module using firewall rules or a reverse proxy that enforces authentication
Remove Verysync instances from direct internet exposure and place them behind a VPN or zero-trust access broker
Audit historical access logs for prior exploitation of /rest/f/api/resources/f96956469e7be39d

Patch Information

No vendor patch has been published. According to the disclosure, the vendor was contacted early but did not respond. Monitor the VulDB advisory and the referenced GitHub issue tracker for updates. Until a fixed release is available, treat all Verysync versions up to 2.21.3 as vulnerable.

Workarounds

Block external access to the /rest/f/api/resources/ path at the reverse proxy or web application firewall
Bind the Verysync Web Administration Module to localhost or a trusted management interface only
Require client certificate authentication or IP allowlisting in front of the administrative service

bash

# Example nginx configuration to restrict the vulnerable endpoint
location /rest/f/api/resources/ {
    allow 10.0.0.0/8;      # Trusted management network
    deny  all;
    proxy_pass http://127.0.0.1:8886;
}