CVE-2025-25205

HIGH

Remote Authentication-Bypass can lead to server crash or limited information disclosure due to faulty pattern matching

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-25205 has a selected CVSS score of 8.2 (high); EIP currently links 1 catalogued exploit.

Description

Audiobookshelf is a self-hosted audiobook and podcast server. Starting in version 2.17.0 and prior to version 2.19.1, a flaw in the authentication bypass logic allows unauthenticated requests to match certain unanchored regex patterns in the URL. Attackers can craft URLs containing substrings like "/api/items/1/cover" in a query parameter (?r=/api/items/1/cover) to partially bypass authentication or trigger server crashes under certain routes. This could lead to information disclosure of otherwise protected data and, in some cases, a complete denial of service (server crash) if downstream code expects an authenticated user object. Version 2.19.1 contains a patch for the issue.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

audiobookshelf

Browse advplyr / audiobookshelf
CVE List>= 2.17.0, < 2.19.1affected

Proofs of concept

1

Catalogued exploits

MetasploitAudiobookshelf Unauthenticated API Authentication Bypass ScannerMetasploit auxiliary PoCby Kenneth LaCroix +1 moreScanner1 file

Ruby

Metasploit
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

This Metasploit auxiliary module detects Audiobookshelf servers vulnerable to CVE-2025-25205 by fingerprinting the version and performing a differential check against a protected API endpoint. It sends a baseline request expected to return 401 and a bypass request with a crafted query parameter; a non-401 response on the bypass request confirms the vulnerability. The module does not exploit the vulnerability to extract data or gain access.

Backdoor review

No backdoor observed in reviewed code

The module is a straightforward vulnerability scanner for CVE-2025-25205. It fingerprints the target, sends a baseline and a bypass HTTP request to detect the authentication bypass, and reports the result. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationScanner
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareaudiobookshelf
Attack typesauthentication_bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module's description and code explicitly state it 'detects' vulnerable servers and performs a differential check to confirm the bypass without exploiting it for data access. It sends requests and observes responses to determine vulnerability status, which is the definition of a scanner.

modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:20-37modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:82-103

Requirements

  • Target must be running Audiobookshelf server accessible over HTTP.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-73
  • The /status endpoint must be reachable and return a JSON document identifying the application as 'audiobookshelf'.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-77

Observed behavior

  • Fingerprints the target by requesting the /status endpoint and parsing the JSON response for the 'serverVersion' field.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:69-80
  • Sends a baseline GET request to /api/libraries and verifies it receives an HTTP 401 response.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:88-93
  • Sends a bypass GET request to /api/libraries with a query parameter 'r' set to '/api/items/1/cover' and checks if the response code is 200 or 500.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:95-102
  • Reports the vulnerability if the bypass is confirmed, or reports the target as safe/appears vulnerable based on version and check results.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:105-121modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:123-144
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Request
Payload withheldThese are the only HTTP requests made by the module, used for fingerprinting and vulnerability detection as described in the module metadata.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:70-73modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:89-92modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:95-99
Vulnerability Report
Payload withheldThe module reports the confirmed vulnerability to the Metasploit database, which is standard behavior for a scanner module.modules/auxiliary/scanner/http/audiobookshelf_auth_bypass.rb:137-143
Review boundaries

What the analysis did not establish

  • Only the module source code and metadata are provided; Metasploit framework mixins, libraries, and external payloads are not expanded, so the exact behavior of send_request_cgi and other helper methods is not visible.
  • The evidence does not include any execution output or network traffic, so the analysis is based solely on static code review.
  • The analysis is limited to the module source code and metadata. Framework mixins (e.g., HttpClient, Scanner) and external payloads are not expanded, but the module itself does not invoke any payloads or exhibit suspicious behavior.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

5