CVE-2025-6444

ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the implementation of the GetErrorResponse method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to relay NTLM credentials in the context of the current user. Was ZDI-CAN-25834.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.zerodayinitiative.com/advisories/ZDI-25-415/	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:servicestack:servicestack:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2025-06-25 18:15

Updated : 2025-08-08 19:18

NVD link : CVE-2025-6444

Mitre link : CVE-2025-6444

CVE.ORG link : CVE-2025-6444

JSON object : View

Products Affected

servicestack

servicestack

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-6444", "cveTags": [], "metrics": {"cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}], "cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2025-06-25T18:15:24.463", "references": [{"url": "https://www.zerodayinitiative.com/advisories/ZDI-25-415/", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affected installations of ServiceStack. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the implementation of the GetErrorResponse method. The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. An attacker can leverage this vulnerability to relay NTLM credentials in the context of the current user. Was ZDI-CAN-25834."}, {"lang": "es", "value": "Vulnerabilidad de retransmisi\u00f3n NTLM por validaci\u00f3n de entrada incorrecta en ServiceStack GetErrorResponse. Esta vulnerabilidad permite a atacantes remotos retransmitir credenciales NTLM en las instalaciones afectadas de ServiceStack. Se requiere la interacci\u00f3n con esta librer\u00eda para explotar esta vulnerabilidad, pero los vectores de ataque pueden variar seg\u00fan la implementaci\u00f3n. La falla espec\u00edfica se encuentra en la implementaci\u00f3n del m\u00e9todo GetErrorResponse. El problema se debe a la falta de una validaci\u00f3n adecuada de los datos proporcionados por el usuario, lo que puede generar una confusi\u00f3n de tipos. Un atacante puede aprovechar esta vulnerabilidad para retransmitir credenciales NTLM en el contexto del usuario actual. Anteriormente, se describi\u00f3 como ZDI-CAN-25834."}], "lastModified": "2025-08-08T19:18:00.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:servicestack:servicestack:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FD8C0B95-859D-43BB-AC7B-163057481E97", "versionEndExcluding": "8.6"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}