CVE-2025-41338: Canaldenuncia.app Auth Bypass Vulnerability

CVE-2025-41338 Overview

CVE-2025-41338 is a missing authorization vulnerability [CWE-862] in CanalDenuncia.app, a whistleblower reporting platform. The flaw resides in the /backend/api/buscarTestigoByIdDenunciaUsuario.php endpoint. An unauthenticated attacker can send a crafted POST request manipulating the id_denuncia and id_user parameters to access other users' confidential report and witness information. The vulnerability is exploitable over the network with no privileges or user interaction required.

Critical Impact

Unauthenticated attackers can retrieve confidential whistleblower and witness records by enumerating identifier parameters, breaching reporter anonymity guarantees.

Affected Products

• CanalDenuncia.app (all versions prior to vendor fix)
• Affected component: /backend/api/buscarTestigoByIdDenunciaUsuario.php
• Reporting backend API exposed to the public internet

Discovery Timeline

• 2025-11-04 - CVE-2025-41338 published to NVD
• 2025-11-05 - Last updated in NVD database

Technical Details for CVE-2025-41338

Vulnerability Analysis

The vulnerability is a broken access control issue classified under [CWE-862] Missing Authorization. The endpoint /backend/api/buscarTestigoByIdDenunciaUsuario.php accepts the id_denuncia (report identifier) and id_user (user identifier) parameters via POST. The backend retrieves and returns the associated witness records without verifying that the caller owns or is authorized to view those records.

Given the platform's purpose, exposed data includes whistleblower complaints, witness identities, and related case material. Disclosure of this information undermines the confidentiality guarantees that are essential to a whistleblower channel and may expose reporters to retaliation. The flaw is exploitable remotely without authentication.

Root Cause

The root cause is the absence of server-side authorization checks on a data-retrieval endpoint. The backend trusts client-supplied identifiers and returns records directly, instead of validating that the authenticated session has permission to read records associated with the supplied id_denuncia and id_user. This is a classic Insecure Direct Object Reference pattern.

Attack Vector

An attacker sends a POST request to /backend/api/buscarTestigoByIdDenunciaUsuario.php with arbitrary values for id_denuncia and id_user. Because identifiers are typically sequential or guessable, attackers can enumerate the parameter space to harvest data across the entire tenant. No authentication, privileges, or user interaction are required, and exploitation leaves only standard HTTP request artifacts in logs.

For full technical context, see the INCIBE Security Notice.

Detection Methods for CVE-2025-41338

Indicators of Compromise

• POST requests to /backend/api/buscarTestigoByIdDenunciaUsuario.php originating from a single source with rapidly incrementing id_denuncia or id_user values
• Unauthenticated or anonymous-session requests reaching the witness-lookup endpoint
• High volume of 200 OK responses returning witness records to an unauthenticated client
• Requests from non-browser User-Agent strings or scripted clients targeting backend API paths

Detection Strategies

• Deploy web application firewall (WAF) rules that flag access to the affected PHP endpoint without a valid session token
• Correlate request rate and parameter variance per source IP to identify enumeration patterns
• Alert on responses containing personally identifiable information (PII) field names returned to unauthenticated requestors

Monitoring Recommendations

• Forward backend HTTP access logs to a centralized SIEM and retain at least 90 days of history for forensic review
• Build dashboards tracking access counts per endpoint and per source IP for all /backend/api/ paths
• Monitor for outbound data egress correlated with API enumeration activity from the application server

How to Mitigate CVE-2025-41338

Immediate Actions Required

• Restrict or block public access to /backend/api/buscarTestigoByIdDenunciaUsuario.php at the WAF or reverse proxy until a vendor fix is applied
• Contact CanalDenuncia.app support to confirm patch availability and apply the fix as soon as it is released
• Review backend access logs for past requests to the affected endpoint and assess potential data exposure
• Notify affected reporters and witnesses if log analysis indicates unauthorized access

Patch Information

No public vendor advisory URL is listed beyond the INCIBE Security Notice. Operators must contact the vendor directly to obtain the patched build. Once available, the fix should enforce server-side authorization that ties record retrieval to the authenticated session owner.

Workarounds

• Place the endpoint behind authenticated access controls enforced at the reverse proxy layer
• Implement WAF rules denying POST requests to the endpoint that lack a valid session cookie
• Replace sequential identifiers with unguessable UUIDs in any custom deployment to reduce enumeration risk
• Rate-limit requests to /backend/api/ paths per source IP to slow mass extraction attempts

# Example nginx configuration to require authenticated session cookie
location = /backend/api/buscarTestigoByIdDenunciaUsuario.php {
    if ($cookie_session = "") {
        return 403;
    }
    limit_req zone=api_limit burst=5 nodelay;
    proxy_pass http://backend;
}