« Volver al listado

CVE-2025-23222

Estado: AplazadaAlta (8.4)—

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L/UI:N) permite a usuarios no privilegiados escalar a root mediante proxy D-Bus que enmascara la identidad; ejecución de código resultante de servicios comprometidos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionAuditUpdate SoftwareThreat Intelligence ProgramRestrict Web-Based Content

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Deepin — Dde-api-proxyAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23222",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23222",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-24T17:40:55.747192Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "Deepin",
          "product": "dde-api-proxy",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "semver",
              "lessThanOrEqual": "1.0.19"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2025-01-24T17:15:15.730",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1229918",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://security.opensuse.org/2025/01/24/dde-api-proxy-privilege-escalation.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2025/01/24/3",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-940"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges."
    },
    {
      "lang": "es",
      "value": "Se descubrió un problema en Deepin dde-api-proxy hasta la versión 1.0.19 en el que los usuarios sin privilegios pueden acceder a los servicios de D-Bus como root. Específicamente, dde-api-proxy se ejecuta como superusuario y reenvía mensajes de usuarios locales arbitrarios a métodos D-Bus heredados en los servicios D-Bus reales, y los servicios D-Bus reales no conocen la situación del proxy (creen que superusuario les está pidiendo que hagan cosas). En consecuencia, varios métodos proxy, que no deberían ser accesibles para usuarios que no sean root, son accesibles para usuarios que no son superusuarios. En situaciones en las que Polkit está involucrado, el llamador sería tratado como administrador, lo que resultaría en una escalada similar de privilegios."
    }
  ],
  "lastModified": "2026-06-17T08:52:45.833",
  "sourceIdentifier": "cve@mitre.org"
}