CVE-2025-6106: 72crm Wukong CRM CSRF Vulnerability

CVE-2025-6106 Overview

CVE-2025-6106 is a Cross-Site Request Forgery (CSRF) vulnerability in WuKongOpenSource WukongCRM 9.0. The flaw resides in unspecified processing within the AdminRoleController.java file. Remote attackers can trigger unauthorized state-changing actions when an authenticated administrator visits a malicious page or link.

The issue is classified under CWE-352: Cross-Site Request Forgery. The exploit has been publicly disclosed. The vendor was contacted prior to publication but did not respond, leaving the vulnerability unpatched at time of disclosure.

Critical Impact
Remote attackers can force authenticated WukongCRM administrators to execute unintended role management operations, potentially altering access controls within the CRM.

Affected Products

WuKongOpenSource WukongCRM 9.0
Component: AdminRoleController.java
Vendor: 72crm

Discovery Timeline

2025-06-16 - CVE-2025-6106 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6106

Vulnerability Analysis

The vulnerability affects the administrative role management functionality of WukongCRM 9.0. The AdminRoleController.java controller handles privileged operations related to role definitions and assignments. It does not enforce anti-CSRF tokens or verify request origin on state-changing endpoints.

An attacker who lures an authenticated administrator to a malicious web page can trigger cross-origin requests that the application processes as legitimate. Because the browser automatically attaches the administrator's session cookies, the CRM executes the forged request under the victim's privileges.

User interaction is required, which limits the attack to social engineering scenarios such as phishing links, malicious advertisements, or watering-hole pages targeting CRM administrators.

Root Cause

The controller lacks two standard CSRF defenses. First, it does not validate a synchronizer token bound to the user session. Second, it does not check the Origin or Referer headers of incoming requests. Any endpoint reachable via a simple HTTP method that mutates server state is exposed to forgery.

Attack Vector

Exploitation follows the classic CSRF pattern. The attacker crafts an HTML page containing an auto-submitting form or image tag that targets a sensitive endpoint exposed by AdminRoleController.java. When the victim administrator loads the page while logged into WukongCRM, the browser issues the request with valid session credentials. The server processes the action without verifying user intent.

See the public GitHub issue tracking CVE-2025-6106 and the VulDB entry #312575 for additional technical detail.

Detection Methods for CVE-2025-6106

Indicators of Compromise

Unexpected role creation, modification, or deletion events in WukongCRM audit logs that do not correlate with active administrator sessions.
HTTP requests to AdminRoleController endpoints with Referer or Origin headers pointing to external, untrusted domains.
Administrator account activity originating from web sessions with recent cross-site navigation to unfamiliar URLs.

Detection Strategies

Enable verbose access logging on the WukongCRM application server and alert on POST/PUT requests to role management endpoints with mismatched Origin and Host headers.
Correlate CRM administrative changes with browser proxy logs or SIEM records of user web activity to identify forged requests.
Deploy a web application firewall (WAF) rule to flag state-changing requests to AdminRoleController paths that lack expected anti-CSRF tokens.

Monitoring Recommendations

Baseline normal administrative activity patterns and alert on off-hours or high-frequency role changes.
Monitor endpoints that visit CRM administrative URLs for concurrent connections to newly seen or low-reputation domains.
Retain HTTP request headers, including Referer and Origin, in centralized logs for retrospective analysis.

How to Mitigate CVE-2025-6106

Immediate Actions Required

Restrict access to WukongCRM administrative interfaces to trusted internal networks or VPN-only reachability.
Instruct administrators to log out of WukongCRM sessions when not actively using the application and to avoid concurrent browsing while authenticated.
Deploy a WAF or reverse proxy rule that enforces Origin and Referer header validation on requests to AdminRoleController routes.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted prior to publication but did not respond. Organizations running WukongCRM 9.0 should treat the deployment as unpatched and apply compensating controls. Monitor the 72crm project repository for future security releases.

Workarounds

Implement a reverse proxy that injects and validates a synchronizer token for all state-changing requests to WukongCRM administrative endpoints.
Enforce SameSite=Strict on WukongCRM session cookies at the proxy layer to prevent cross-origin cookie transmission.
Require re-authentication or step-up verification before sensitive role changes take effect, using an upstream identity provider.
Segment the CRM behind a bastion or zero-trust access broker so that administrator browsers cannot reach both the CRM and arbitrary internet content in the same session.

bash

# Example nginx configuration enforcing Origin validation
# for WukongCRM admin role endpoints
location ~ ^/AdminRole {
    if ($http_origin !~* ^https://crm\.internal\.example\.com$) {
        return 403;
    }
    if ($request_method ~ ^(POST|PUT|DELETE)$) {
        if ($http_referer !~* ^https://crm\.internal\.example\.com/) {
            return 403;
        }
    }
    proxy_pass http://wukongcrm_backend;
}