CVE-2025-3574: Deporsite IDOR Information Disclosure Flaw

CVE-2025-3574 Overview

CVE-2025-3574 is an Insecure Direct Object Reference (IDOR) vulnerability affecting the Deporsite application developed by T-INNOVA. The flaw resides in the /helper/Familia/obtenerFamiliaUsuario endpoint, which fails to validate authorization on the idUsuario parameter. An unauthenticated attacker can manipulate this parameter to retrieve sensitive information belonging to other users. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact

Remote, unauthenticated attackers can enumerate user identifiers and extract confidential personal data from arbitrary user accounts without authentication or user interaction.

Affected Products

• Deporsite by T-INNOVA (sports facility management platform)
• Specific affected versions not disclosed in the public advisory
• Endpoint: /helper/Familia/obtenerFamiliaUsuario

Discovery Timeline

• 2025-04-15 - CVE-2025-3574 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-3574

Vulnerability Analysis

The vulnerability stems from missing authorization controls on the obtenerFamiliaUsuario helper endpoint within Deporsite. The application accepts an idUsuario parameter directly from the client and uses it to query family-related user records without verifying whether the requesting session owns or is permitted to access the referenced identifier.

This pattern is a classic Insecure Direct Object Reference. The server trusts the user-supplied object key and returns data tied to that key. An attacker can iterate through sequential or guessable idUsuario values to harvest personally identifiable information at scale.

The attack requires no credentials and no user interaction. Because the request occurs over a standard HTTP request to a network-reachable endpoint, exploitation is trivial using common tooling such as curl or Burp Suite Intruder.

Root Cause

The root cause is a failure to enforce object-level authorization. The application authenticates the request session (or fails to require authentication entirely) but does not check whether the session principal is authorized to read records associated with the supplied idUsuario. This maps directly to CWE-639.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to /helper/Familia/obtenerFamiliaUsuario, substituting the idUsuario parameter with target user identifiers. The server responds with sensitive data belonging to those users, including family membership information.

No verified exploit code has been published. Refer to the INCIBE Security Notice for the official advisory.

Detection Methods for CVE-2025-3574

Indicators of Compromise

• Repeated HTTP requests to /helper/Familia/obtenerFamiliaUsuario with sequentially varying idUsuario values
• High volume of successful 200 OK responses from a single source IP to the affected endpoint
• Unusual user-agent strings or scripted request patterns targeting the helper endpoints

Detection Strategies

• Inspect web server and application logs for enumeration patterns against the idUsuario parameter
• Correlate request rate and response size anomalies on the /helper/Familia/ URI path
• Deploy WAF rules that flag sequential numeric parameter manipulation against authenticated endpoints

Monitoring Recommendations

• Enable verbose access logging for all /helper/ endpoints in Deporsite
• Forward web logs to a centralized SIEM and alert on high-frequency parameter iteration
• Baseline normal idUsuario access patterns per session and alert on deviations

How to Mitigate CVE-2025-3574

Immediate Actions Required

• Contact T-INNOVA to obtain the latest patched build of Deporsite and confirm fix availability
• Restrict network exposure of the affected endpoint to trusted networks until a patch is applied
• Audit web access logs for prior exploitation attempts against /helper/Familia/obtenerFamiliaUsuario
• Notify affected users if log review reveals unauthorized data retrieval

Patch Information

No public patch identifier is listed in the NVD record. Customers should consult T-INNOVA directly and review the INCIBE Security Notice for vendor coordination details.

Workarounds

• Implement a reverse proxy or WAF rule that validates the requester's session against the idUsuario value before forwarding requests
• Block external access to the /helper/Familia/obtenerFamiliaUsuario endpoint where business workflows allow
• Apply rate limiting to the affected endpoint to slow enumeration attempts
• Rotate or invalidate session tokens if log review indicates compromise

# Example NGINX rule restricting access to internal networks
location /helper/Familia/obtenerFamiliaUsuario {
    allow 10.0.0.0/8;
    deny all;
    limit_req zone=helper_zone burst=5 nodelay;
    proxy_pass http://deporsite_backend;
}