CVE-2025-4015: Novel-plus Auth Bypass Vulnerability

CVE-2025-4015 Overview

CVE-2025-4015 is a missing authentication vulnerability in xxyopen Novel-Plus, an open-source online novel reading and management system. The flaw resides in the list function within novel-system/src/main/java/com/java2nb/system/controller/SessionController.java. Affected versions include all commits up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160.

The vulnerability allows remote attackers to invoke the session listing endpoint without supplying valid credentials. The exploit has been publicly disclosed. According to the VulDB advisory, the vendor was contacted prior to disclosure but did not respond. The weakness is classified under [CWE-287] Improper Authentication and [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can access the SessionController.list endpoint, exposing session data that should require administrative authentication.

Affected Products

xxyopen Novel-Plus (all versions up to commit 0e156c04b4b7ce0563bef6c97af4476fcda8f160)
Component: novel-system module
File: novel-system/src/main/java/com/java2nb/system/controller/SessionController.java

Discovery Timeline

2025-04-28 - CVE-2025-4015 published to NVD
2025-10-17 - Last updated in NVD database

Technical Details for CVE-2025-4015

Vulnerability Analysis

The vulnerability exists in the list function of the SessionController class in the Novel-Plus admin backend. This controller is intended to enumerate active user sessions, which is an administrative function. The endpoint lacks the authentication checks required to restrict access to authenticated administrators.

Because the controller method is exposed over HTTP without enforcing a valid session, role check, or authentication interceptor, any remote client can issue a request and receive a response. This breaks the principle that critical functions must verify the identity of the caller before executing privileged logic, the exact condition described in [CWE-306].

The public disclosure on VulDB and a related write-up on CNBlogs make exploitation straightforward, since the vulnerable route, HTTP method, and parameters are documented.

Root Cause

The root cause is the absence of an authentication or authorization annotation on the list handler in SessionController.java. Spring-based controllers in Novel-Plus typically rely on framework-level interceptors or annotations such as @RequiresPermissions to gate sensitive endpoints. The affected handler is reachable through the application's URL routing without traversing those access checks.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request directly to the session listing endpoint exposed by the novel-system module. The server processes the request and returns session-related data without challenging the caller for credentials. This data can be used to enumerate active users and plan follow-on attacks against the administrative interface.

No verified proof-of-concept code is published in NVD references. The vulnerability mechanism is described in the VulDB advisory and the CNBlogs analysis.

Detection Methods for CVE-2025-4015

Indicators of Compromise

Unauthenticated HTTP requests to administrative paths handled by SessionController in the novel-system module.
Access log entries showing successful 200 responses to session listing endpoints without a preceding authentication request.
Bulk requests from a single source IP enumerating session identifiers or user identifiers.

Detection Strategies

Review application access logs for requests to SessionController routes that originate from IPs that never authenticated.
Deploy a web application firewall rule that requires a valid session cookie or admin token before allowing requests to /system/session/* paths.
Correlate session enumeration activity with subsequent login attempts to detect reconnaissance leading to credential attacks.

Monitoring Recommendations

Forward Novel-Plus access logs and Spring application logs to a central analytics platform for retention and querying.
Alert on response payload sizes that indicate session listings being returned to anonymous callers.
Track repeated requests to the novel-system module endpoints from non-administrative network segments.

How to Mitigate CVE-2025-4015

Immediate Actions Required

Restrict network access to the Novel-Plus admin backend by placing it behind a VPN or IP allowlist until a vendor fix is available.
Manually patch SessionController.java to enforce authentication, for example by adding the @RequiresPermissions or equivalent Spring Security annotation that protects sibling admin endpoints.
Audit application access logs for prior unauthenticated requests to the session listing endpoint.

Patch Information

No vendor-supplied patch is referenced in the NVD entry at the time of publication. The vendor did not respond to the disclosure attempt recorded by VulDB. Operators should track the Novel-Plus repository for upstream fixes and apply a local code change that requires authentication on the list handler.

Workarounds

Add an authentication interceptor in the Spring configuration that covers all SessionController routes by default.
Block external access to the novel-system administrative paths at the reverse proxy or load balancer layer.
Disable the session listing endpoint entirely if it is not required for operations.

bash

# Example nginx configuration to block external access to the admin module
location /system/session/ {
    allow 10.0.0.0/8;
    deny all;
}