CVE-2025-55043: MuraCMS CSRF Vulnerability

CVE-2025-55043 Overview

CVE-2025-55043 is a Cross-Site Request Forgery (CSRF) vulnerability affecting MuraCMS through version 10.1.10. The vulnerability exists in the bundle creation functionality, specifically within the csettings.cfc createBundle method. This security flaw allows unauthenticated attackers to force administrators to create and save site bundles containing sensitive data to publicly accessible directories.

Critical Impact

This CSRF vulnerability enables complete data exfiltration from MuraCMS installations without requiring authentication. Attackers can force administrators to unknowingly create site bundles containing user accounts, password hashes, form submissions, email lists, plugins, and site content—all saved to publicly accessible web directories for unauthorized download.

Affected Products

• MuraCMS through version 10.1.10
• MuraCMS installations with default bundle creation functionality enabled
• Web servers hosting MuraCMS with publicly accessible bundle directories

Discovery Timeline

• 2026-03-18 - CVE-2025-55043 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2025-55043

Vulnerability Analysis

This CSRF vulnerability exploits the lack of proper anti-CSRF token validation in the MuraCMS bundle creation functionality. The createBundle method within csettings.cfc accepts requests without verifying that they originate from legitimate administrator sessions. When an authenticated administrator visits a malicious webpage or clicks a crafted link, the attacker can trigger the bundle creation process without the administrator's knowledge or consent.

The attack is particularly dangerous because site bundles in MuraCMS contain comprehensive exports of the entire CMS installation, including sensitive configuration data, user credentials, and content. Once created, these bundles are saved to directories accessible via the web server, allowing attackers to download the exfiltrated data at their convenience.

The vulnerability requires user interaction (an administrator must be tricked into visiting a malicious page while authenticated), but the attack executes silently, leaving no obvious indication that sensitive data has been compromised.

Root Cause

The root cause of CVE-2025-55043 is the absence of CSRF protection mechanisms in the csettings.cfc createBundle method. The MuraCMS application fails to implement proper anti-CSRF tokens or origin validation when processing bundle creation requests. This allows cross-origin requests from attacker-controlled websites to execute privileged operations in the context of an authenticated administrator session.

Additionally, the default behavior of saving bundles to publicly accessible directories compounds the severity, as it enables attackers to retrieve the exfiltrated data without requiring further access to the system.

Attack Vector

The attack leverages the network-based CSRF vector to exploit the missing request validation. An attacker crafts a malicious webpage containing a hidden form or JavaScript that automatically submits a request to the MuraCMS createBundle endpoint. When an authenticated MuraCMS administrator visits this malicious page, their browser automatically includes session cookies with the request, causing the server to process it as a legitimate administrative action.

The malicious request instructs MuraCMS to create a comprehensive site bundle containing all sensitive data and save it to a predictable, publicly accessible location. The attacker can then download this bundle directly from the web server without any authentication, gaining access to user accounts, password hashes, form submissions, email lists, plugins, and all site content.

Detection Methods for CVE-2025-55043

Indicators of Compromise

• Unexpected site bundle files appearing in public web directories (e.g., /assets/, /bundles/, or similar export locations)
• Web server access logs showing requests to bundle download endpoints from unfamiliar IP addresses
• Unusual administrative activity patterns, particularly bundle creation actions occurring outside normal working hours
• Referrer headers in access logs indicating bundle creation requests originating from external domains

Detection Strategies

• Implement file integrity monitoring (FIM) on MuraCMS bundle export directories to detect unauthorized file creation
• Configure web application firewall (WAF) rules to detect and block CSRF attack patterns targeting CMS administrative endpoints
• Enable and review MuraCMS audit logs for bundle creation events, correlating them with administrator activity records
• Monitor for HTTP requests to csettings.cfc with createBundle actions that lack proper CSRF tokens or have suspicious referrer headers

Monitoring Recommendations

• Deploy SentinelOne agents to monitor filesystem changes in web directories and detect anomalous bundle file creation
• Configure alerting for any bundle creation activity that occurs without corresponding legitimate administrator sessions
• Establish baseline metrics for administrative actions and alert on deviations from normal patterns
• Regularly audit publicly accessible directories for sensitive files that should not be exposed

How to Mitigate CVE-2025-55043

Immediate Actions Required

• Upgrade MuraCMS to version 10.14 or later, which contains security fixes for this vulnerability
• Remove or restrict access to any existing bundle files in publicly accessible directories
• Implement network-level access controls to limit administrative interface access to trusted IP ranges
• Review web server logs for evidence of exploitation and rotate all administrative credentials if compromise is suspected
• Configure Content Security Policy (CSP) headers to restrict the domains from which scripts can execute

Patch Information

Mura Software has addressed this vulnerability in version 10.14. Administrators should consult the Mura Software Release Notes 10.14 for detailed upgrade instructions and additional security improvements included in this release.

For organizations unable to immediately upgrade, implementing additional web application firewall rules and restricting administrative interface access can reduce exposure while preparing for the update.

Workarounds

• Configure web server rules to block external requests to the csettings.cfc endpoint until patches can be applied
• Implement reverse proxy rules requiring additional authentication headers for administrative CFC endpoints
• Move bundle storage directories outside the web root to prevent public access to exported files
• Enable SameSite cookie attributes (SameSite=Strict) for MuraCMS session cookies to mitigate CSRF attacks
• Deploy a web application firewall with CSRF protection rules targeting the MuraCMS administrative interface

For environments where patching is delayed, consider the following web server configuration to restrict access to sensitive CFC files. Consult your web server documentation for implementation details specific to your environment, and test thoroughly before deploying to production systems.