CVE-2025-62523: Thm Pilos CORS CSRF Vulnerability

CVE-2025-62523 Overview

CVE-2025-62523 is a Cross-Origin Resource Sharing (CORS) misconfiguration in PILOS (Platform for Interactive Live-Online Seminars), a frontend for BigBlueButton. Versions prior to 4.8.0 reflect the Origin request header back into the Access-Control-Allow-Origin response header without validation while Access-Control-Allow-Credentials is set to true. A malicious cross-origin site could theoretically issue authenticated requests to the PILOS API on behalf of a victim. Laravel's session-origin protections mitigate practical exploitation in typical deployments. The issue is tracked under CWE-942: Permissive Cross-domain Policy with Untrusted Domains and was patched in PILOS v4.8.0.

Critical Impact
Reflected-Origin CORS with credentials could permit cross-origin authenticated requests, though Laravel's default session-origin checks render exploitation unlikely in standard PILOS deployments.

Affected Products

PILOS (THM-Health) versions prior to 4.8.0
Deployments using PILOS as a BigBlueButton frontend
Laravel-based PILOS API endpoints exposing session-authenticated resources

Discovery Timeline

2025-10-27 - CVE-2025-62523 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62523

Vulnerability Analysis

The flaw resides in PILOS's HTTP middleware stack, which registered Laravel's HandleCors middleware with a permissive configuration. The middleware reflected the incoming Origin header directly into the Access-Control-Allow-Origin response header. Combined with Access-Control-Allow-Credentials: true, this configuration signals browsers to include session cookies on cross-origin requests. A user visiting a malicious page in an authenticated PILOS session could have their browser issue credentialed requests to the PILOS API.

The practical impact is constrained by Laravel's session middleware, which applies additional origin and CSRF checks that reject cross-origin state-changing requests by default. The vendor notes the misconfiguration is not believed to be exploitable in typical deployments barring an additional session-origin bypass.

Root Cause

The root cause is the inclusion of \Illuminate\Http\Middleware\HandleCors::class in app/Http/Kernel.php without a restrictive allowlist for permitted origins. Reflecting arbitrary origins while allowing credentials violates OWASP CORS guidance and matches [CWE-942].

Attack Vector

An attacker hosts a page on an arbitrary origin that issues fetch or XMLHttpRequest calls to a PILOS instance with credentials: 'include'. If a victim visits the page while authenticated to PILOS, the browser attaches session cookies. Absent Laravel's session-origin protections, the API would process the request as authenticated. User interaction (visiting the attacker page) is required.

php

// Patch: removal of the permissive HandleCors middleware from the global stack
         \Illuminate\Foundation\Http\Middleware\InvokeDeferredCallbacks::class,
         \App\Http\Middleware\TrustHosts::class,
         \App\Http\Middleware\TrustProxies::class,
-        \Illuminate\Http\Middleware\HandleCors::class,
         \App\Http\Middleware\PreventRequestsDuringMaintenance::class,
         \Illuminate\Foundation\Http\Middleware\ValidatePostSize::class,
         \App\Http\Middleware\TrimStrings::class,

Source: PILOS commit 14655bc

php

// Patch: session regeneration after logging out other sessions
         if ($session) {
             $this->logoutOtherSessions($session);
+
+            // Recreate new session for the requesting session
+            session()->regenerate(true);
         } else {
             $this->logoutAllSessions();
         }

Source: PILOS commit 14655bc

Detection Methods for CVE-2025-62523

Indicators of Compromise

HTTP responses from PILOS reflecting arbitrary Origin values into Access-Control-Allow-Origin while returning Access-Control-Allow-Credentials: true.
Web server access logs showing preflight OPTIONS requests followed by credentialed cross-origin POST or PUT calls from unexpected referrers.
Session activity for authenticated PILOS users originating from browsers with referrers outside the deployment's trusted domains.

Detection Strategies

Send probe requests with arbitrary Origin headers (e.g., Origin: https://attacker.example) and verify whether PILOS reflects the value with credentials enabled.
Review app/Http/Kernel.php in deployed PILOS instances to confirm removal of the global HandleCors middleware or presence of a strict origin allowlist.
Monitor Laravel application logs for anomalous cross-origin authenticated API activity against /api/* endpoints.

Monitoring Recommendations

Alert on outbound CORS responses that echo untrusted origins on session-bearing endpoints.
Track PILOS API request patterns for referrer or origin values not matching the deployment's canonical hostname.
Log and review 4xx and 3xx responses to OPTIONS preflight requests as a signal of cross-origin probing.

How to Mitigate CVE-2025-62523

Immediate Actions Required

Upgrade PILOS to version 4.8.0 or later, which removes the permissive CORS middleware and hardens session handling.
Audit reverse proxy or web server configurations (nginx, Apache) for any additional CORS headers that may reintroduce the reflection behavior.
Force session regeneration and invalidate long-lived sessions after patching to reset any potentially exposed authenticated state.

Patch Information

The fix is delivered in PILOS v4.8.0 via commit 14655bc. The patch removes \Illuminate\Http\Middleware\HandleCors::class from the global middleware stack in app/Http/Kernel.php and adds explicit session regeneration in AuthenticationService. Full details are documented in GHSA-pgfw-f4mp-5445.

Workarounds

Restrict CORS at the reverse proxy layer by whitelisting only the PILOS canonical origin and stripping any reflected Access-Control-Allow-Origin headers.
Disable Access-Control-Allow-Credentials on endpoints that do not require cross-origin credentialed access.
Enforce SameSite=Lax or SameSite=Strict on session cookies to prevent browsers from attaching them to cross-origin requests.

bash

# Example nginx configuration enforcing a strict CORS allowlist
map $http_origin $cors_allow_origin {
    default "";
    "https://pilos.example.org" $http_origin;
}

server {
    location /api/ {
        add_header Access-Control-Allow-Origin $cors_allow_origin always;
        add_header Access-Control-Allow-Credentials "true" always;
        add_header Vary "Origin" always;
    }
}