CVE-2025-64061 Overview
CVE-2025-64061 is an information disclosure vulnerability in Primakon Pi Portal version 1.0.18, part of the Primakon Project Contract Management (PCM) suite. The /api/v2/users endpoint enforces authentication but lacks role-based access control. Any authenticated user, including low-privileged accounts, can issue a GET request and receive the full list of registered users. The response body exposes password hashes for every account. The flaw maps to CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere.
Critical Impact
Any authenticated user can extract the complete user directory along with password hashes, enabling offline credential cracking and lateral movement across the application.
Affected Products
- Primakon Pi Portal 1.0.18
- Primakon Project Contract Management (PCM) suite
- Deployments exposing the /api/v2/users REST endpoint
Discovery Timeline
- 2025-11-25 - CVE-2025-64061 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-64061
Vulnerability Analysis
The Primakon Pi Portal exposes a REST endpoint at /api/v2/users that returns the roster of application users. Authentication is required to reach the endpoint, but the application does not verify the caller's role or privilege level before returning data. A standard user account produces the same response as an administrative account.
The returned JSON payload includes password hashes for every user record. An attacker who compromises or registers any low-privileged account gains immediate access to credential material for every other user, including administrators. Offline cracking of weak or reused hashes then enables account takeover and privilege escalation within the platform.
Root Cause
The root cause is broken access control combined with over-exposure of sensitive fields in the API response. The endpoint's authorization layer checks only for a valid session token and omits a role check. The user serializer additionally returns hash material that should never leave the authentication subsystem, satisfying the pattern described by CWE-497.
Attack Vector
Exploitation requires network access to the Pi Portal API and valid credentials for any account. The attacker authenticates, obtains a session token, and issues a GET request to /api/v2/users. The server responds with the full user list and embedded password hashes. No user interaction, elevated privileges, or specialized tooling is required beyond a standard HTTP client. Additional technical detail is available in the public vulnerability write-up.
Detection Methods for CVE-2025-64061
Indicators of Compromise
- GET requests to /api/v2/users originating from non-administrative user sessions.
- Large or repeated JSON responses from the users endpoint containing hash fields such as password, passwordHash, or hash.
- Session tokens belonging to standard accounts accessing user-management APIs outside of expected UI workflows.
Detection Strategies
- Instrument the Pi Portal reverse proxy or web application firewall (WAF) to flag /api/v2/users requests where the authenticated principal is not a member of an administrative group.
- Correlate authentication logs with API access logs to identify newly created or low-privileged accounts issuing directory enumeration requests.
- Perform response inspection to detect password hash patterns (bcrypt, Argon2, or MD5/SHA prefixes) leaving the application boundary.
Monitoring Recommendations
- Forward Pi Portal access logs to a centralized SIEM and alert on privilege-mismatched access to /api/v2/users.
- Baseline normal API usage per role and generate anomaly alerts when standard users invoke administrative endpoints.
- Monitor downstream identity systems for credential-stuffing and brute-force attempts that may follow offline hash cracking.
How to Mitigate CVE-2025-64061
Immediate Actions Required
- Restrict network exposure of the /api/v2/users endpoint at the proxy or WAF layer to administrative source addresses only until a patch is applied.
- Force a password reset for all Pi Portal accounts, assuming hashes may already have been exfiltrated.
- Audit application logs for prior unauthorized GET requests to /api/v2/users from non-administrative sessions.
Patch Information
No vendor advisory or fixed version was listed in NVD at the time of publication. Contact Primakon for guidance on remediated releases of the Project Contract Management platform and consult the Primakon PCM product page for support channels.
Workarounds
- Enforce role-based access control at the API gateway to reject /api/v2/users requests from non-administrative roles.
- Strip password hash fields from API responses using a response-rewriting rule on the reverse proxy.
- Rotate hashing algorithms to a modern, salted scheme (bcrypt or Argon2) so that any previously leaked hashes have limited cracking value.
- Enable multi-factor authentication (MFA) on all Pi Portal accounts to reduce the impact of credential recovery from stolen hashes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
