CVE-2025-53634

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53634

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

C

hall-Manager is a platform-agnostic system able to start Challenges on Demand of a player. The HTTP Gateway processes headers, but with no timeout set. With a slow loris attack, an attacker could cause Denial of Service (DoS). Exploitation does not require authentication nor authorization, so anyone can exploit it. It should nonetheless not be exploitable as it is highly recommended to bury Chall-Manager deep within the infrastructure due to its large capabilities, so no users could reach the system. Patch has been implemented by commit 1385bd8 and shipped in v0.1.4.

References
Link Resource
https://github.com/ctfer-io/chall-manager/commit/1385bd869142651146cd0b123085f91cec698636 Patch
https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4 Release Notes
https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-ggmv-j932-q89q Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:*
History

14 Aug 2025, 20:41

Type Values Removed Values Added
References () https://github.com/ctfer-io/chall-manager/commit/1385bd869142651146cd0b123085f91cec698636 - () https://github.com/ctfer-io/chall-manager/commit/1385bd869142651146cd0b123085f91cec698636 - Patch
References () https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4 - () https://github.com/ctfer-io/chall-manager/releases/tag/v0.1.4 - Release Notes
References () https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-ggmv-j932-q89q - () https://github.com/ctfer-io/chall-manager/security/advisories/GHSA-ggmv-j932-q89q - Vendor Advisory
First Time Ctfer-io
Ctfer-io chall-manager
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
CPE cpe:2.3:a:ctfer-io:chall-manager:*:*:*:*:*:*:*:*

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) Chall-Manager es un sistema independiente de la plataforma, capaz de iniciar desafíos a petición de un jugador. La puerta de enlace HTTP procesa los encabezados, pero sin tiempo de espera establecido. Con un ataque lento de Loris, un atacante podría causar una denegación de servicio (DoS). Su explotación no requiere autenticación ni autorización, por lo que cualquiera puede hacerlo. Sin embargo, no debería ser explotable, ya que se recomienda encarecidamente integrar Chall-Manager en la infraestructura debido a sus amplias capacidades, de modo que ningún usuario pueda acceder al sistema. El parche se implementó mediante el commit 1385bd8 y se publicó en la versión v0.1.4.

10 Jul 2025, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-10 20:15

Updated : 2025-08-14 20:41

NVD link : CVE-2025-53634

Mitre link : CVE-2025-53634

CVE.ORG link : CVE-2025-53634

JSON object : View

Products Affected

ctfer-io

CWE
CWE-770

Allocation of Resources Without Limits or Throttling