CVE-2025-62376: pwn.college DOJO Auth Bypass Vulnerability

CVE-2025-62376 Overview

CVE-2025-62376 is an improper authentication vulnerability in the pwn.college DOJO cybersecurity education platform that allows unauthorized access to any user's active Windows VM. The vulnerability exists in the /workspace endpoint's view_desktop function, where user identity is retrieved via a URL parameter without verifying that the requester has administrative privileges. This allows an attacker to supply any user ID and an arbitrary password to impersonate another user and gain full access to their Windows VM environment.

Critical Impact
An attacker can access and modify data on any active Windows VM and the associated Linux home directory via the Z: drive, compromising the confidentiality and integrity of all users with active Windows VMs on the platform.

Affected Products

pwn.college DOJO (versions prior to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef)

Discovery Timeline

2025-10-14 - CVE-2025-62376 published to NVD
2025-12-03 - Last updated in NVD database

Technical Details for CVE-2025-62376

Vulnerability Analysis

This vulnerability is classified as CWE-287 (Improper Authentication). The flaw resides in the view_desktop function within the workspace API endpoint. When a user requests access to a Windows desktop service, the function retrieves the target user based on a user_id URL parameter without performing any authorization check to verify whether the requesting user has the necessary privileges to access that user's VM.

The authentication bypass allows any authenticated user to request access to another user's Windows VM by simply specifying their user ID in the request. The function proceeds to generate access credentials and returns an iframe source URL that grants full interactive access to the target VM, including keyboard and mouse control through the VNC interface.

Root Cause

The root cause is a missing authorization check in the view_desktop function when handling Windows desktop service requests. The function accepts a user_id parameter and retrieves the corresponding user object without verifying that the requester has administrative privileges. Additionally, the supplied password parameter is not validated against any stored credentials before generating the access URL, effectively allowing any arbitrary password to work.

Attack Vector

This vulnerability is exploitable over the network by any authenticated user of the pwn.college DOJO platform. An attacker can craft a request to the /workspace endpoint specifying a target user_id parameter to access another user's Windows VM. The attack requires:

Valid authentication to the DOJO platform
Knowledge or enumeration of target user IDs
A simple HTTP request to the workspace endpoint with the victim's user ID

The attack grants full access to the victim's Windows VM environment, including the ability to view screen contents, interact with the desktop, access files, and modify data. The Z: drive mapping also provides access to the victim's Linux home directory.

python

             iframe_src = url_for("pwncollege_workspace.forward_workspace", service=service_param, service_path="vnc.html", **vnc_params)
 
         elif service == "desktop-windows":
+            if user_id and not is_admin():
+                abort(403)
+            
             service_param = "~".join(("desktop-windows", str(user.id), container_password(container, "desktop-windows")))
             vnc_params = {
                 "autoconnect": 1,

Source: GitHub Commit Change

The patch adds an authorization check that aborts the request with a 403 Forbidden response if a user_id is provided and the requester is not an administrator.

Detection Methods for CVE-2025-62376

Indicators of Compromise

Unusual access patterns to the /workspace endpoint with varying user_id parameters from a single session
Multiple workspace access requests for different user IDs in rapid succession
Access logs showing user_id parameters that do not match the authenticated user's ID
VNC connection logs indicating access to Windows VMs from unexpected source users

Detection Strategies

Monitor workspace API endpoint logs for requests containing user_id parameters from non-administrative users
Implement alerting on access patterns where a single authenticated user requests workspace access for multiple different user IDs
Cross-reference workspace access requests with user role assignments to identify unauthorized access attempts
Deploy web application firewall rules to flag suspicious parameter manipulation on the workspace endpoint

Monitoring Recommendations

Enable detailed logging for all workspace endpoint requests including authentication context and request parameters
Implement user behavior analytics to detect anomalous workspace access patterns
Set up alerts for 403 responses at the workspace endpoint after applying the patch, which may indicate exploitation attempts
Review historical access logs for evidence of prior exploitation before the patch was applied

How to Mitigate CVE-2025-62376

Immediate Actions Required

Update pwn.college DOJO to commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef or later immediately
Review workspace access logs for signs of unauthorized VM access
Notify users with active Windows VMs to audit their VM contents for unauthorized modifications
Consider temporarily disabling Windows VM functionality until the patch is applied

Patch Information

The vulnerability has been patched in commit 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef. The fix adds an authorization check that verifies the requester has administrative privileges before allowing access to another user's Windows desktop service. For detailed information about the security fix, see the GitHub Security Advisory GHSA-344w-77p7-gx2c.

Workarounds

No known workarounds exist for this vulnerability according to the security advisory
As a temporary measure, consider disabling the Windows desktop service functionality until the patch can be applied
Implement network-level access controls to restrict workspace endpoint access to trusted IP ranges
Add a web application firewall rule to block requests with user_id parameters from non-administrative users

bash

# Apply the security patch
cd /path/to/dojo
git fetch origin
git checkout 467db0b9ea0d9a929dc89b41f6eb59f7cfc68bef
# Restart the DOJO service to apply changes
systemctl restart dojo