CVE-2025-23363: Siemens Teamcenter CSRF Vulnerability

CVE-2025-23363 Overview

A vulnerability has been identified in Siemens Teamcenter that affects the Single Sign-On (SSO) login service. The affected applications accept user-controlled input that could specify a link to an external site, enabling an Open Redirect attack. This could allow an attacker to redirect legitimate users to an attacker-chosen URL to steal valid session data. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.

Critical Impact
Attackers can craft malicious links that redirect authenticated users to external sites, potentially stealing session tokens and enabling account takeover through phishing attacks.

Affected Products

Siemens Teamcenter V14.1 (All versions)
Siemens Teamcenter V14.2 (All versions)
Siemens Teamcenter V14.3 (All versions < V14.3.0.14)
Siemens Teamcenter V2312 (All versions < V2312.0010)
Siemens Teamcenter V2406 (All versions < V2406.0008)
Siemens Teamcenter V2412 (All versions < V2412.0004)

Discovery Timeline

February 11, 2025 - CVE-2025-23363 published to NVD
September 24, 2025 - Last updated in NVD database

Technical Details for CVE-2025-23363

Vulnerability Analysis

This vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site), commonly known as an Open Redirect vulnerability. The SSO login service in Siemens Teamcenter fails to properly validate redirect URLs provided in user-controlled input parameters. When a user authenticates through the SSO service, the application accepts a return URL parameter that specifies where to redirect the user after successful authentication.

The attack requires user interaction—specifically, the victim must click on a malicious link crafted by the attacker. Once clicked, the user is redirected through the legitimate Teamcenter SSO service to an attacker-controlled external site. This makes the attack particularly effective for phishing campaigns, as the initial URL appears to belong to a trusted Siemens domain.

Root Cause

The root cause of this vulnerability lies in insufficient validation of the redirect URL parameter within the SSO login service. The application does not properly verify that the destination URL belongs to an authorized domain or follows a whitelist of acceptable redirect targets. This allows attackers to inject arbitrary external URLs into the redirect parameter, which the application then honors after user authentication.

Attack Vector

The attack is executed over the network and requires the attacker to craft a specially designed URL containing a malicious redirect parameter. The attack flow typically involves:

The attacker creates a link to the legitimate Teamcenter SSO endpoint with a manipulated redirect parameter pointing to an attacker-controlled site
The attacker distributes this link via email, social engineering, or other means
When a victim clicks the link and authenticates (or is already authenticated), they are redirected to the malicious external site
The attacker-controlled site can then harvest session cookies, credentials, or perform additional phishing attacks

The vulnerability exploits the trust users place in legitimate Siemens Teamcenter URLs. Since the initial domain appears trustworthy, users are more likely to click the link and less likely to notice they have been redirected to a malicious site after authentication.

Detection Methods for CVE-2025-23363

Indicators of Compromise

Unusual redirect URLs in SSO login requests containing external domain references
Web server logs showing authentication requests with redirect parameters pointing to non-organizational domains
User reports of unexpected redirects after logging into Teamcenter
Phishing emails containing Teamcenter SSO URLs with suspicious redirect parameters

Detection Strategies

Monitor web application logs for SSO login requests with redirect parameters containing external or unexpected URLs
Implement URL pattern matching rules to detect redirect parameters pointing to non-whitelisted domains
Deploy web application firewalls (WAF) with rules to block requests containing suspicious redirect patterns
Review authentication logs for patterns of redirects to untrusted external sites

Monitoring Recommendations

Enable detailed logging on Teamcenter SSO service endpoints to capture full request URLs including parameters
Configure SIEM alerts for redirect parameter patterns that include external domain references
Implement network traffic analysis to detect connections to known malicious domains following Teamcenter authentication
Establish baseline monitoring for normal redirect patterns to identify anomalous activity

How to Mitigate CVE-2025-23363

Immediate Actions Required

Upgrade Teamcenter V14.3 to version V14.3.0.14 or later
Upgrade Teamcenter V2312 to version V2312.0010 or later
Upgrade Teamcenter V2406 to version V2406.0008 or later
Upgrade Teamcenter V2412 to version V2412.0004 or later
For Teamcenter V14.1 and V14.2, contact Siemens support as no patches are currently available for these versions

Patch Information

Siemens has released security patches addressing this vulnerability in newer versions of Teamcenter. Organizations should consult the Siemens Security Advisory SSA-656895 for detailed patch information and download instructions. For Teamcenter versions V14.1 and V14.2 where all versions are affected, organizations should consider upgrading to a supported version or implementing the workarounds described below.

Workarounds

Implement a web application firewall (WAF) rule to validate and restrict redirect URLs to a whitelist of trusted internal domains
Educate users about the risks of clicking links in emails and to verify URLs before entering credentials
Consider implementing additional security controls at the network perimeter to block redirects to untrusted external sites
Deploy endpoint detection solutions to identify and block phishing attempts that leverage this vulnerability

bash

# Example WAF rule to restrict redirects (implementation varies by WAF vendor)
# This blocks SSO redirect parameters containing external URLs
# Adjust the regex pattern to match your organization's legitimate redirect destinations
SecRule ARGS:redirect "@rx ^https?://(?!.*\.yourdomain\.com)" \
    "id:100001,phase:1,deny,status:403,msg:'Blocked potential open redirect attack'"