CVE-2025-60949: Csprousers Csweb Info Disclosure Flaw

CVE-2025-60949 Overview

CVE-2025-60949 is a critical information exposure vulnerability in Census CSWeb 8.0.1 that allows the app/config directory to be reachable via HTTP in certain deployment configurations. A remote, unauthenticated attacker could exploit this flaw by sending requests to configuration files, potentially obtaining leaked secrets including credentials, API keys, and other sensitive configuration data.

Critical Impact
Unauthenticated attackers can remotely access configuration files containing sensitive secrets, potentially leading to full system compromise through credential theft.

Affected Products

CSProUsers CSWeb version 8.0.1
Deployments where app/config is accessible via HTTP
Systems not updated to version 8.1.0 alpha or later

Discovery Timeline

2026-03-23 - CVE-2025-60949 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2025-60949

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The issue stems from improper access controls in certain CSWeb deployments where the application configuration directory is inadvertently exposed through the web server. When exploited, this allows unauthenticated remote attackers to directly request configuration files that may contain database credentials, API tokens, encryption keys, and other sensitive application secrets.

The vulnerability requires no user interaction and can be exploited over the network without any authentication, making it particularly dangerous for internet-facing deployments. Successful exploitation could lead to complete compromise of the application and potentially connected systems if credentials for other services are stored in the exposed configuration files.

Root Cause

The root cause of this vulnerability is improper access control configuration that fails to restrict HTTP access to the app/config directory. In vulnerable deployment scenarios, the web server does not properly deny requests to sensitive configuration paths, allowing directory contents to be enumerated and configuration files to be downloaded by unauthenticated users.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests directly to the app/config endpoint on vulnerable CSWeb installations. The attack is straightforward - the attacker simply needs to discover a vulnerable instance and request configuration files through standard HTTP GET requests. No specialized tools or exploit code is required; a web browser or simple HTTP client is sufficient to retrieve sensitive configuration data.

The vulnerability affects deployments where the web server configuration does not properly restrict access to the application's configuration directory. Once configuration files are obtained, attackers can extract credentials and secrets to pivot to other attacks, including database access, administrative control, or lateral movement within the network.

Detection Methods for CVE-2025-60949

Indicators of Compromise

HTTP requests targeting /app/config or similar configuration paths in web server access logs
Unexpected access to configuration files from external IP addresses
Multiple sequential requests attempting to enumerate directory contents
Evidence of credential misuse following potential configuration exposure

Detection Strategies

Monitor web server access logs for requests to /app/config and related configuration endpoints
Implement web application firewall (WAF) rules to block requests to sensitive configuration paths
Deploy intrusion detection signatures for configuration file access attempts
Review authentication logs for anomalous access patterns using potentially exposed credentials

Monitoring Recommendations

Enable verbose logging on web servers hosting CSWeb applications
Configure alerts for any HTTP 200 responses to configuration directory requests
Monitor for unauthorized access attempts using credentials stored in configuration files
Implement file integrity monitoring on configuration directories to detect unauthorized access

How to Mitigate CVE-2025-60949

Immediate Actions Required

Upgrade CSWeb to version 8.1.0 alpha or later which contains the security fix
Review web server configuration to ensure app/config directory is not accessible via HTTP
Rotate all credentials, API keys, and secrets that may have been exposed in configuration files
Audit access logs to determine if the vulnerability has already been exploited

Patch Information

The vulnerability has been fixed in CSWeb version 8.1.0 alpha. Organizations should update to this version or later to remediate the vulnerability. The fix can be reviewed in the GitHub Commit provided by the CSProUsers team.

For additional technical details, refer to the CISA CSAF Advisory and the official CVE-2025-60949 Record.

Workarounds

Configure web server (Apache, Nginx, etc.) to explicitly deny access to the app/config directory
Move configuration files outside the web root directory if possible
Implement network-level access controls to restrict access to CSWeb administration paths
Use a reverse proxy to filter requests to sensitive paths before they reach the application

bash

# Example Apache .htaccess configuration to block config directory access
<Directory "/path/to/csweb/app/config">
    Order deny,allow
    Deny from all
</Directory>

# Example Nginx configuration
location /app/config {
    deny all;
    return 403;
}