CVE-2025-60949: Csprousers Csweb Info Disclosure Flaw

CVE-2025-60949 Overview

CVE-2025-60949 is a critical information exposure vulnerability in Census CSWeb 8.0.1 that allows the app/config directory to be reachable via HTTP in certain deployment configurations. A remote, unauthenticated attacker could exploit this flaw by sending requests to configuration files, potentially obtaining leaked secrets including credentials, API keys, and other sensitive configuration data.

Critical Impact

Unauthenticated attackers can remotely access configuration files containing sensitive secrets, potentially leading to full system compromise through credential theft.

Affected Products

• CSProUsers CSWeb version 8.0.1
• Deployments where app/config is accessible via HTTP
• Systems not updated to version 8.1.0 alpha or later

Discovery Timeline

• 2026-03-23 - CVE-2025-60949 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-60949

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue stems from improper access controls in certain CSWeb deployments where the application configuration directory is inadvertently exposed through the web server. When exploited, this allows unauthenticated remote attackers to directly request configuration files that may contain database credentials, API tokens, encryption keys, and other sensitive application secrets.

The vulnerability requires no user interaction and can be exploited over the network without any authentication, making it particularly dangerous for internet-facing deployments. Successful exploitation could lead to complete compromise of the application and potentially connected systems if credentials for other services are stored in the exposed configuration files.

Root Cause

The root cause of this vulnerability is improper access control configuration that fails to restrict HTTP access to the app/config directory. In vulnerable deployment scenarios, the web server does not properly deny requests to sensitive configuration paths, allowing directory contents to be enumerated and configuration files to be downloaded by unauthenticated users.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests directly to the app/config endpoint on vulnerable CSWeb installations. The attack is straightforward - the attacker simply needs to discover a vulnerable instance and request configuration files through standard HTTP GET requests. No specialized tools or exploit code is required; a web browser or simple HTTP client is sufficient to retrieve sensitive configuration data.

The vulnerability affects deployments where the web server configuration does not properly restrict access to the application's configuration directory. Once configuration files are obtained, attackers can extract credentials and secrets to pivot to other attacks, including database access, administrative control, or lateral movement within the network.

Detection Methods for CVE-2025-60949

Indicators of Compromise

• HTTP requests targeting /app/config or similar configuration paths in web server access logs
• Unexpected access to configuration files from external IP addresses
• Multiple sequential requests attempting to enumerate directory contents
• Evidence of credential misuse following potential configuration exposure

Detection Strategies

• Monitor web server access logs for requests to /app/config and related configuration endpoints
• Implement web application firewall (WAF) rules to block requests to sensitive configuration paths
• Deploy intrusion detection signatures for configuration file access attempts
• Review authentication logs for anomalous access patterns using potentially exposed credentials

Monitoring Recommendations

• Enable verbose logging on web servers hosting CSWeb applications
• Configure alerts for any HTTP 200 responses to configuration directory requests
• Monitor for unauthorized access attempts using credentials stored in configuration files
• Implement file integrity monitoring on configuration directories to detect unauthorized access

How to Mitigate CVE-2025-60949

Immediate Actions Required

• Upgrade CSWeb to version 8.1.0 alpha or later which contains the security fix
• Review web server configuration to ensure app/config directory is not accessible via HTTP
• Rotate all credentials, API keys, and secrets that may have been exposed in configuration files
• Audit access logs to determine if the vulnerability has already been exploited

Patch Information

The vulnerability has been fixed in CSWeb version 8.1.0 alpha. Organizations should update to this version or later to remediate the vulnerability. The fix can be reviewed in the GitHub Commit provided by the CSProUsers team.

For additional technical details, refer to the CISA CSAF Advisory and the official CVE-2025-60949 Record.

Workarounds

• Configure web server (Apache, Nginx, etc.) to explicitly deny access to the app/config directory
• Move configuration files outside the web root directory if possible
• Implement network-level access controls to restrict access to CSWeb administration paths
• Use a reverse proxy to filter requests to sensitive paths before they reach the application

# Example Apache .htaccess configuration to block config directory access
<Directory "/path/to/csweb/app/config">
    Order deny,allow
    Deny from all
</Directory>

# Example Nginx configuration
location /app/config {
    deny all;
    return 403;
}