CVE-2025-62604: MeterSphere Auth Bypass Vulnerability

CVE-2025-62604 Overview

CVE-2025-62604 is an authentication bypass vulnerability in MeterSphere, an open source continuous testing platform. A logic flaw in the third-party authentication flow allows retrieval of arbitrary user information. An unauthenticated attacker can leverage this disclosure to log in to the system as any user, including privileged accounts. The flaw affects all MeterSphere LTS releases prior to 2.10.25-lts and has been patched in version 2.10.25-lts. The weakness is tracked under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

Critical Impact
Unauthenticated attackers can impersonate any MeterSphere user, including administrators, exposing test artifacts, source linkage, credentials, and pipeline integrations.

Affected Products

MeterSphere LTS versions prior to 2.10.25-lts
MeterSphere deployments using third-party authentication paths (LoginController, LdapService)
Self-hosted MeterSphere instances exposing the gateway service to network-reachable users

Discovery Timeline

2025-10-22 - CVE-2025-62604 published to NVD
2025-10-28 - Last updated in NVD database

Technical Details for CVE-2025-62604

Vulnerability Analysis

The vulnerability resides in the MeterSphere gateway module responsible for handling login and third-party authentication. The LoginController and LdapService components mishandle session and identity validation during authentication. This allows an unauthenticated request flow to retrieve user records that should require established authentication. Because the returned identity material is sufficient to establish a session, the disclosure escalates directly into account takeover. The flaw is a business logic error rather than a memory-safety defect, and it is reachable over the network without prior credentials.

Root Cause

The root cause is improper enforcement of session and source-of-truth checks during the third-party authentication path. The patched commit removes implicit reliance on SessionConstants and restructures the LDAP authentication service, indicating that session state was being trusted before it was properly established. This violates the principle of complete mediation for authentication requests.

Attack Vector

The attack vector is network-based against the MeterSphere gateway HTTP endpoints. An attacker crafts a request to the authentication flow to retrieve arbitrary user information, then replays the disclosed identity material to obtain a valid session as the targeted user. No user interaction is required on the victim side.

java

// Patched files in commit b984fe74e84711ff326b0a348807c31fadf134af
// framework/gateway/src/main/java/io/metersphere/gateway/controller/LoginController.java
 import io.metersphere.gateway.service.SystemParameterService;
 import io.metersphere.gateway.service.UserLoginService;
 import io.metersphere.request.LoginRequest;
-import io.swagger.v3.oas.annotations.Operation;
 import jakarta.annotation.Resource;
 import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.StringUtils;

// framework/gateway/src/main/java/io/metersphere/gateway/service/LdapService.java
 import io.metersphere.base.domain.User;
 import io.metersphere.commons.constants.ParamConstants;
-import io.metersphere.commons.constants.SessionConstants;
 import io.metersphere.commons.constants.UserSource;
 import io.metersphere.commons.exception.MSException;
 import io.metersphere.commons.user.SessionUser;

Source: GitHub commit b984fe7

Detection Methods for CVE-2025-62604

Indicators of Compromise

Unexpected successful authentications immediately following requests to the gateway login or LDAP authentication endpoints without prior credential submission.
Multiple session establishments from a single source IP across distinct user identities within a short window.
Access to administrative MeterSphere routes from accounts that historically only authenticated via standard SSO or local login.

Detection Strategies

Inspect MeterSphere gateway access logs for unauthenticated requests that resolve user records, particularly under the LoginController and LdapService paths.
Correlate authentication events with downstream API actions to identify session creation that lacks a corresponding password or SSO exchange.
Compare deployed MeterSphere version metadata against 2.10.25-lts to identify exposed instances.

Monitoring Recommendations

Forward MeterSphere gateway logs to a centralized logging or SIEM platform and alert on anomalous login sequences.
Monitor for new administrator-level session activity outside of approved change windows.
Track network reachability of MeterSphere gateway ports from untrusted segments and flag external exposure.

How to Mitigate CVE-2025-62604

Immediate Actions Required

Upgrade all MeterSphere LTS instances to version 2.10.25-lts or later without delay.
Invalidate active sessions and rotate any API tokens or integration credentials that may have been retrieved during the exposure window.
Restrict network access to the MeterSphere gateway so it is reachable only from trusted networks or via a VPN.

Patch Information

The issue is fixed in MeterSphere v2.10.25-lts. The remediation is documented in GitHub Security Advisory GHSA-vj5x-7374-rf96 and applied in commit b984fe7, which refactors the gateway LoginController and LdapService to enforce proper authentication state handling.

Workarounds

Place MeterSphere behind an authenticating reverse proxy that enforces an additional identity check before requests reach the gateway.
Disable third-party and LDAP authentication paths until the upgrade to 2.10.25-lts is completed if those flows are not required.
Apply network-layer allowlists limiting access to the gateway service to known administrative source ranges.

bash

# Verify the installed MeterSphere version and upgrade via the official release
docker inspect metersphere/metersphere --format '{{.Config.Image}}'

# Pull the patched image
docker pull metersphere/metersphere:v2.10.25-lts

# Restrict gateway exposure with a host firewall (example: ufw)
sudo ufw default deny incoming
sudo ufw allow from 10.0.0.0/8 to any port 8081 proto tcp
sudo ufw reload