CVE-2025-24968 Overview
CVE-2025-24968 is a broken access control vulnerability in reNgine, an automated reconnaissance framework for web applications. The flaw allows authenticated users with limited roles such as penetration_tester or auditor to delete all projects in the system. Once every project is deleted, reNgine redirects the actor to the onboarding page. From the onboarding flow, the attacker can create or modify users, including Sys Admins, and configure critical settings such as API keys and user preferences. All versions up to and including 2.20 are affected, and no fix or workaround is currently available.
Critical Impact
A low-privileged authenticated user can fully take over the reNgine application, including administrative account creation and API key configuration.
Affected Products
- reNgine by yogeshojha, all versions up to and including 2.20
- Self-hosted reNgine deployments exposing the web UI to authenticated users
- Multi-tenant reNgine instances with non-admin roles such as penetration_tester or auditor
Discovery Timeline
- 2025-02-04 - CVE-2025-24968 published to the National Vulnerability Database (NVD)
- 2025-05-13 - Last updated in NVD database
Technical Details for CVE-2025-24968
Vulnerability Analysis
The vulnerability is a broken access control issue mapped to [CWE-284]. reNgine exposes a project deletion function that does not verify whether the calling user has administrative privileges. Any role that can authenticate to the application, including penetration_tester and auditor, can invoke the deletion endpoint and remove every project stored in the system.
Deleting all projects shifts reNgine into an uninitialized state. The application interprets the empty project list as a fresh install and redirects the user to the onboarding workflow. The onboarding workflow grants the actor the ability to create administrative accounts and reconfigure global settings. This converts a limited reconnaissance role into full administrative control.
The attack chain requires only network access to the reNgine web interface and a valid low-privilege account. No user interaction is required from an administrator. Because reNgine often stores API keys for third-party reconnaissance services, takeover can also expose downstream credentials.
Root Cause
The root cause is missing authorization checks on the project deletion handler. The endpoint relies on authentication alone and does not enforce role-based access control. Combined with the onboarding redirect triggered by an empty project list, the missing check escalates a destructive action into administrative takeover.
Attack Vector
An authenticated attacker with penetration_tester or auditor privileges issues delete requests against every project in the reNgine instance. Once the project list is empty, the attacker navigates to the application root and is redirected to the onboarding page. The attacker then creates a new Sys Admin account, sets API keys, and modifies user preferences to consolidate control.
No verified public exploit code is available. See the reNgine GitHub Security Advisory GHSA-3327-6x79-q396 for vendor details.
Detection Methods for CVE-2025-24968
Indicators of Compromise
- Sudden disappearance of all projects from the reNgine dashboard or database
- Web server access logs showing repeated DELETE requests against project endpoints from a non-admin session
- Creation of new Sys Admin accounts immediately following bulk project deletions
- Unexpected modifications to API keys or user preferences in the onboarding flow
Detection Strategies
- Audit reNgine application logs for project deletion actions performed by penetration_tester or auditor roles
- Correlate project deletion events with subsequent visits to the onboarding endpoint from the same session
- Alert on administrative user creation events that occur outside of established change windows
Monitoring Recommendations
- Forward reNgine application and reverse proxy logs to a centralized logging platform for retention and correlation
- Monitor outbound use of API keys configured in reNgine for anomalous third-party service activity
- Track session activity for low-privilege accounts that perform high-volume destructive operations
How to Mitigate CVE-2025-24968
Immediate Actions Required
- Restrict network access to the reNgine web interface to trusted administrators using firewall rules or a reverse proxy with IP allowlisting
- Audit existing reNgine user accounts and remove unnecessary penetration_tester and auditor roles
- Back up the reNgine database and project configuration so that deletion events can be reversed
- Rotate any API keys stored within reNgine in case of suspected compromise
Patch Information
At the time of publication, no vendor patch is available. Users are advised to monitor the reNgine GitHub Security Advisory GHSA-3327-6x79-q396 for future releases that address this issue.
Workarounds
- No vendor-supplied workaround exists for CVE-2025-24968
- Limit account provisioning to trusted Sys Admin users until a fix is released
- Place reNgine behind an authenticating reverse proxy to add an additional access control layer
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
