CVE-2025-29929: Enalean Tuleap CSRF Vulnerability

CVE-2025-29929 Overview

CVE-2025-29929 is a Cross-Site Request Forgery (CSRF) vulnerability in Tuleap, an open source suite for managing software development and collaboration. The tracker hierarchy administration interface lacks CSRF protection, allowing attackers to trick authenticated victims into submitting or editing artifacts and follow-up comments. The flaw is classified under CWE-352 (Cross-Site Request Forgery). The issue affects both Tuleap Community Edition and Tuleap Enterprise Edition prior to the fixed releases.

Critical Impact

Attackers can leverage a victim's authenticated session to modify tracker artifacts or follow-up comments through crafted web requests, compromising data integrity in project management workflows.

Affected Products

• Enalean Tuleap Community Edition prior to 16.5.99.1742306712
• Enalean Tuleap Enterprise Edition prior to 16.5-5
• Enalean Tuleap Enterprise Edition prior to 16.4-8

Discovery Timeline

• 2025-03-31 - CVE-2025-29929 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-29929

Vulnerability Analysis

The vulnerability resides in the tracker hierarchy administration functionality of Tuleap. This administrative interface accepts state-changing HTTP requests without validating a CSRF token, meaning the server cannot distinguish requests intentionally issued by a user from requests forged by a third-party site.

When an authenticated Tuleap user visits an attacker-controlled page, the browser automatically attaches the user's session cookies to any request targeting the Tuleap instance. The attacker abuses this browser behavior to issue requests that submit or edit artifacts and follow-up comments on behalf of the victim.

Exploitation requires user interaction, since the victim must load the malicious page while authenticated to Tuleap. The attack is remotely triggerable over the network and impacts data integrity, though it does not directly disclose confidential information.

Root Cause

The root cause is missing CSRF token validation on endpoints exposed by the tracker hierarchy administration component. The fix, delivered in commit dce61747f3a169da1f6b585ad5e6e0847fa3c950, adds anti-CSRF token verification so the server rejects state-changing requests that do not include a valid, session-bound token.

Attack Vector

An attacker hosts a malicious page containing an auto-submitting HTML form or JavaScript request targeting a Tuleap tracker hierarchy administration endpoint. When an authenticated Tuleap administrator visits the page, the browser issues the forged request with valid session cookies. The Tuleap server processes the request as legitimate, allowing the attacker to submit or edit artifacts and follow-up comments without direct access to the victim's credentials.

See the GitHub Security Advisory GHSA-hqqr-p5f6-26vv for additional technical context.

Detection Methods for CVE-2025-29929

Indicators of Compromise

• Unexpected artifact modifications or follow-up comments attributed to administrative users who did not intentionally perform the action.
• HTTP POST requests to tracker hierarchy administration endpoints with a Referer or Origin header pointing to an external, untrusted domain.
• Bursts of tracker modifications occurring shortly after a user visited an unknown external URL.

Detection Strategies

• Review Tuleap web server access logs for state-changing requests to tracker administration endpoints where the Origin or Referer does not match the Tuleap deployment hostname.
• Correlate audit trail entries in the tracker module with user session activity to identify modifications that lack a corresponding user-initiated navigation.
• Deploy web application firewall (WAF) rules that flag cross-origin submissions to Tuleap administrative paths.

Monitoring Recommendations

• Enable and centralize Tuleap application logs, including tracker administration audit events, in a SIEM for correlation.
• Alert on anomalous edit volumes performed by administrator accounts outside of business hours.
• Track browser session activity for administrators to detect concurrent Tuleap requests originating from unusual referrers.

How to Mitigate CVE-2025-29929

Immediate Actions Required

• Upgrade Tuleap Community Edition to version 16.5.99.1742306712 or later.
• Upgrade Tuleap Enterprise Edition to 16.5-5 or 16.4-8 depending on your current release branch.
• Instruct administrators to log out of Tuleap sessions when browsing untrusted sites until patches are applied.

Patch Information

The fix is delivered in commit dce61747f3a169da1f6b585ad5e6e0847fa3c950, published in the Enalean Tuleap GitHub repository and mirrored on the Tuleap.net stable branch. Tracking details are available in Tuleap issue 42231.

Workarounds

• Restrict access to the Tuleap administrative interface using network-level controls such as VPN or IP allow-listing.
• Configure browsers or corporate policies to enforce strict SameSite=Lax or SameSite=Strict cookie behavior for the Tuleap domain.
• Require administrators to use a dedicated browser profile for Tuleap administration to reduce exposure to cross-site request forgery.

# Configuration example: enforce SameSite cookie attribute at the reverse proxy (nginx)
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";