Attack Chain

1. The attacker identifies a target running Census CSWeb 8.0.1.
2. The attacker sends an HTTP GET request to /app/config directory or specific files within that directory.
3. The vulnerable server processes the request without proper authentication or access controls.
4. The server responds with the contents of the configuration files, potentially containing sensitive information.
5. The attacker parses the configuration files to extract sensitive data, such as API keys, database credentials, or internal IP addresses.
6. The attacker uses the extracted credentials to gain unauthorized access to databases, APIs, or other systems.
7. The attacker escalates privileges within the compromised systems.

Impact

Successful exploitation of CVE-2025-60949 can lead to the exposure of sensitive information, including API keys, database credentials, and other secrets. This can allow attackers to gain unauthorized access to critical systems, leading to data breaches, financial loss, and reputational damage. The vulnerability affects all deployments of Census CSWeb 8.0.1 where the /app/config directory is exposed via HTTP.

Recommendation

• Upgrade to Census CSWeb version 8.1.0 alpha or later to patch CVE-2025-60949.
• Implement access controls to restrict access to the /app/config directory to authorized personnel only.
• Deploy the Sigma rule “Detect Unauthenticated Access to Configuration Files” to identify potential exploitation attempts.
• Monitor web server logs for requests to /app/config to detect unauthorized access attempts.