CVE-2025-54969: BAE SOCET GXP CSRF Vulnerability

CVE-2025-54969 Overview

CVE-2025-54969 is a Cross-Site Request Forgery (CSRF) vulnerability in BAE Systems SOCET GXP versions prior to 4.6.0.2. The SOCET GXP Job Status Service fails to implement CSRF protections on incoming requests. An attacker who convinces an authenticated user to click a crafted link or visit a malicious website can submit unauthorized requests to the Job Status Service. The requests execute in the victim's session context without their knowledge. SOCET GXP is a geospatial exploitation product used for imagery analysis, mapping, and mission planning workflows.

Critical Impact
Attackers can forge requests to the SOCET GXP Job Status Service through a victim's browser, bypassing user intent and impacting integrity and availability of job processing.

Affected Products

BAE Systems SOCET GXP versions prior to 4.6.0.2
SOCET GXP Job Status Service component
Geospatial Exploitation Products (GXP) product family

Discovery Timeline

2025-10-27 - CVE-2025-54969 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-54969

Vulnerability Analysis

The vulnerability is classified under [CWE-352]: Cross-Site Request Forgery. The SOCET GXP Job Status Service processes HTTP requests without verifying that they originate from an intentional user action. The service lacks anti-CSRF tokens, SameSite cookie attributes, or Origin/Referer header validation. An authenticated user browsing the web while logged into SOCET GXP becomes a request proxy for the attacker. Any state-changing operation exposed by the Job Status Service can be triggered through embedded HTML forms, image tags, or JavaScript fetch calls on an attacker-controlled page.

Root Cause

The root cause is the absence of request origin validation in the Job Status Service. Web applications must confirm that state-changing requests are intentional. SOCET GXP relies solely on session cookies for authentication, which browsers attach automatically to cross-origin requests. Without secondary validation such as a synchronizer token or double-submit cookie, the service cannot distinguish legitimate user actions from forged submissions.

Attack Vector

Exploitation requires user interaction. An attacker crafts a webpage or email containing a hidden request targeting the SOCET GXP Job Status Service endpoint. When a currently authenticated SOCET GXP user visits that page, the browser silently issues the request with valid session credentials. The service processes it as an authorized action. The scope is changed because the vulnerable service affects resources beyond the security context of the vulnerable component.

No public proof-of-concept is available for CVE-2025-54969. Refer to the Geospatial Exploitation CVE Disclosure for vendor technical details.

Detection Methods for CVE-2025-54969

Indicators of Compromise

Job Status Service requests originating from browsers with Referer headers pointing to untrusted external domains
Unexpected job submissions or status modifications occurring outside normal analyst working hours
HTTP requests to Job Status endpoints missing anti-CSRF tokens in POST bodies

Detection Strategies

Inspect web proxy and reverse proxy logs for cross-origin requests targeting SOCET GXP Job Status endpoints
Correlate user browsing activity with SOCET GXP job submissions to identify requests without corresponding user-interface interactions
Alert on anomalous Referer or Origin headers when accessing the Job Status Service

Monitoring Recommendations

Enable verbose HTTP request logging on the SOCET GXP application server and forward logs to a centralized SIEM
Monitor authenticated user sessions for job operations submitted in rapid succession from external referrers
Track failed authentication and anomalous session reuse patterns tied to Job Status Service activity

How to Mitigate CVE-2025-54969

Immediate Actions Required

Upgrade all SOCET GXP installations to version 4.6.0.2 or later as published by BAE Systems
Instruct SOCET GXP users to log out of the application when not actively performing analysis tasks
Restrict SOCET GXP web interfaces to trusted internal networks where feasible

Patch Information

BAE Systems addressed CVE-2025-54969 in SOCET GXP version 4.6.0.2. Administrators should consult the Geospatial Exploitation CVE Disclosure for the official advisory and patch acquisition procedures. Additional product information is available in the BAE Systems Product Overview.

Workarounds

Enforce browser isolation for analysts using SOCET GXP so the authenticated session cannot be reached from arbitrary websites
Configure network-level controls to block SOCET GXP requests carrying external Origin or Referer headers
Deliver user awareness training focused on phishing links and unsolicited attachments while sessions are active

bash

# Configuration example: enforce SameSite and secure cookies at a reverse proxy
# NGINX snippet applied in front of SOCET GXP Job Status Service
proxy_cookie_path / "/; HTTPOnly; Secure; SameSite=Strict";

# Block cross-origin POST requests missing an internal Referer
map $http_referer $csrf_block {
    default 1;
    "~^https://socetgxp\.internal\.example\.com/" 0;
}

server {
    location /jobstatus/ {
        if ($request_method = POST) {
            if ($csrf_block) { return 403; }
        }
        proxy_pass http://socetgxp_backend;
    }
}