CVE-2025-4430 Overview
CVE-2025-4430 is a missing authorization vulnerability [CWE-862] in EZD RP, an electronic document management system used by Polish public administration. The flaw exists in the /api/Token/gettoken endpoint, which fails to enforce authorization checks. An attacker with low-privileged network access can obtain tokens and perform unauthorized file manipulation. The issue affects all EZD RP versions before 20.19, released on 22nd August 2024. CERT Polska published the advisory describing the impact on confidentiality and integrity of stored documents.
Critical Impact
Authenticated attackers can abuse the exposed token endpoint to read and manipulate files belonging to other users, undermining document confidentiality and integrity in government workflows.
Affected Products
- EZD RP versions prior to 20.19
- EZD RP deployments operated by Polish public administration entities
- Any integration relying on the vulnerable /api/Token/gettoken endpoint
Discovery Timeline
- 2025-05-14 - CVE-2025-4430 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-4430
Vulnerability Analysis
The vulnerability stems from missing authorization controls on the /api/Token/gettoken endpoint exposed by EZD RP. The endpoint issues authentication tokens without validating whether the requester is permitted to obtain them for the target context. An attacker with valid low-privilege credentials can request tokens and use them to interact with file resources outside their authorization scope.
The weakness maps to [CWE-862] Missing Authorization. EZD RP processes official electronic documents for Polish public administration, so exploitation directly affects records, correspondence, and case files managed by the platform. Successful exploitation allows file manipulation including reading, modifying, or replacing stored documents handled by other users.
The vendor addressed the issue in version 20.19, published on 22nd August 2024. CERT Polska coordinated disclosure and published the technical advisory.
Root Cause
The /api/Token/gettoken endpoint did not enforce server-side authorization checks before issuing tokens. The application trusted client-supplied parameters when generating tokens scoped to file operations. As a result, an authenticated user could request tokens granting access to files they should not be able to manipulate.
Attack Vector
The attack is network-based and requires low privileges with no user interaction. The attacker authenticates to EZD RP with a valid account, sends a crafted request to /api/Token/gettoken, and receives a token usable for file-manipulation operations. The token is then replayed against file APIs to read or modify documents. Public exploit code is not currently available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified exploitation code is publicly available. Refer to the CERT Polska CVE-2025-4430 Advisory for additional technical context.
Detection Methods for CVE-2025-4430
Indicators of Compromise
- Unexpected requests to /api/Token/gettoken from low-privileged accounts, especially in bursts or with unusual parameters
- Token issuance events followed by file read, write, or delete operations on documents outside the requesting user's case load
- HTTP 200 responses on /api/Token/gettoken correlated with anomalous file-endpoint activity from the same session
Detection Strategies
- Inspect application and web-server logs for repeated /api/Token/gettoken calls grouped by source IP, account, or session identifier
- Correlate token issuance with subsequent file API calls and flag cases where the acting user is not the document owner or assignee
- Establish a baseline of normal EZD RP API usage per role and alert on deviations such as cross-tenant or cross-department access
Monitoring Recommendations
- Forward EZD RP web and API logs to a centralized SIEM or data lake for retention and correlation
- Enable alerting on privilege-sensitive endpoints including /api/Token/gettoken and downstream file APIs
- Track failed and successful authorization decisions to detect enumeration or token-reuse patterns
How to Mitigate CVE-2025-4430
Immediate Actions Required
- Upgrade EZD RP to version 20.19 or later as published by the vendor on 22nd August 2024
- Inventory all EZD RP instances, including test and staging environments, and confirm patch status
- Rotate session tokens and review recent access logs for the /api/Token/gettoken endpoint
Patch Information
The vendor fixed the missing authorization flaw in EZD RP version 20.19, released on 22nd August 2024. Operators should apply this release or any later version. Coordinated disclosure details are published in the CERT Polska CVE-2025-4430 Advisory, and operator guidance is available via the Polish Government EZD RP Resource.
Workarounds
- Restrict network access to EZD RP management and API endpoints to trusted internal networks and VPN segments
- Place a reverse proxy or web application firewall in front of EZD RP to block or rate-limit requests to /api/Token/gettoken from unexpected sources
- Review and tighten role-based access controls so that account compromise yields the smallest possible authorization scope
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
