CVE-2025-48996: HAX Open-APIs Information Disclosure Flaw

CVE-2025-48996 Overview

CVE-2025-48996 is an unauthenticated information disclosure vulnerability in the HAX open-apis project, which provides microservice APIs for the HAX webcomponents repository. The flaw resides in the haxPsuUsage API endpoint used by the Penn State University deployment of the HAX content management system. Any remote unauthenticated user can query the endpoint to retrieve a full list of PSU websites hosted on HAX CMS. The issue affects open-apis versions up to and including 10.0.2. It is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data]. Commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 patches the vulnerability.

Critical Impact
Unauthenticated attackers can enumerate PSU-hosted HAX CMS websites, and when chained with other authorization issues such as HAX-3, this reconnaissance can enable targeted attacks including unauthorized content modification or deletion.

Affected Products

HAX open-apis versions up to and including 10.0.2
Penn State University HAX CMS deployment
HAX webcomponents microservice infrastructure

Discovery Timeline

2025-06-02 - CVE-2025-48996 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48996

Vulnerability Analysis

The haxPsuUsage endpoint returns the full stats payload fetched from the environment variable HAX_STATS. This payload includes a complete enumeration of PSU websites hosted on HAX CMS rather than only aggregate usage metrics. Because the endpoint requires no authentication, any remote user can request it directly and receive detailed site-level information. The disclosure aids reconnaissance against downstream authorization weaknesses in the platform, such as the related HAX-3 issue. The vulnerability is classified under [CWE-201] and impacts confidentiality without directly affecting integrity or availability.

Root Cause

The root cause is over-permissive response construction in api/services/stats/haxPsuUsage.js. The handler passed the entire data object from the stats source back to the caller with stdResponse(res, data || [], options). This surfaced granular per-site records that were never intended for public exposure. A secondary contributing factor was the presence of a broadly accessible example endpoint in api/community/haxPsuStats.js derived from a duckduckgo.js scaffold.

Attack Vector

Exploitation requires only network access to the vulnerable API. An attacker issues an HTTP request to the haxPsuUsage endpoint and receives the full stats JSON in the response body. No credentials, user interaction, or elevated privileges are required. The retrieved site list can then be used as target seed data for follow-on attacks against endpoints with weaker authorization enforcement.

javascript

// Patch in api/services/stats/haxPsuUsage.js
// process.env.HAX_STATS has our stats compiled by our staging system
let data = await fetch(process.env.HAX_STATS).then((res) => {
  return res.json()
})
// only return overall data
if (data) {
  res = stdResponse(res, {overall: data.overall} || [], options);
}
else {
  res = invalidRequest(res, 'data from stats failed to load');
}
// Source: https://github.com/haxtheweb/open-apis/commit/06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7

The patch restricts the response to {overall: data.overall}, ensuring only aggregate statistics are returned. The companion commit also removes the example api/community/haxPsuStats.js scaffold that duplicated similar exposure.

Detection Methods for CVE-2025-48996

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to the haxPsuUsage endpoint from external IP ranges.
Response payloads containing per-site fields beyond the overall object being served to public clients.
Repeated enumeration requests to /api/services/stats/haxPsuUsage from a single source over a short interval.

Detection Strategies

Review web server and API gateway logs for access to the haxPsuUsage endpoint, correlating source IPs against known internal or authorized networks.
Compare deployed open-apis version against the fixed commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 in the GitHub Commit Update.
Inspect API responses for the presence of granular site records rather than only the overall object.

Monitoring Recommendations

Enable rate limiting and anomaly alerting on the haxPsuUsage endpoint to flag scraping behavior.
Alert on outbound response sizes that exceed the expected baseline for aggregate statistics.
Monitor for chained access patterns targeting HAX CMS content modification endpoints following stats endpoint enumeration.

How to Mitigate CVE-2025-48996

Immediate Actions Required

Upgrade HAX open-apis to a version that includes commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7 or later.
Audit any forks or downstream deployments of open-apis versions up to 10.0.2 for the vulnerable handler.
Restrict public access to the haxPsuUsage endpoint via network controls until the patch is applied.

Patch Information

The fix is published in the GitHub Security Advisory and applied in commit 06c2e1fbb7131a8fe66aa0600f38dcacae6b7ac7. The patch modifies api/services/stats/haxPsuUsage.js to return only {overall: data.overall} and removes the example api/community/haxPsuStats.js handler.

Workarounds

Place the haxPsuUsage endpoint behind authentication or an allowlist at the reverse proxy or API gateway.
Temporarily disable the vulnerable route until upgrading is possible.
Filter responses at an upstream proxy so that only the overall object is forwarded to clients.

bash

# Example nginx configuration restricting the endpoint to internal networks
location /api/services/stats/haxPsuUsage {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://open_apis_backend;
}