CVE-2019-25447: 
Homebrew vulnerability analysis and mitigation

CVE-2019-25447 is a Cross-Site Request Forgery (CSRF) vulnerability in OrientDB 3.0.17 GA Community Edition that allows low-privileged attackers to perform unauthorized database operations by crafting malicious requests to endpoints such as /database/, /command/, and /document/. The vulnerability is compounded by reflected and stored XSS weaknesses in the web interface. It was published on February 20, 2026, and affects specifically OrientDB version 3.0.17. It carries a CVSS v3.1 base score of 3.5 (Low) (Red Hat CVE, Feedly).

The root cause is classified as CWE-352 (Cross-Site Request Forgery), stemming from the absence of CSRF token validation on state-changing API endpoints in OrientDB's web interface. An attacker who can trick an authenticated user into visiting a malicious page can cause that user's browser to send forged requests to OrientDB endpoints — including /database/, /command/, and /document/ — without any token-based verification. The vulnerability is further amplified by reflected and stored XSS issues in the web UI, which can be chained to deliver the CSRF payload without requiring the victim to visit an external site. A proof-of-concept exploit is publicly available on Exploit-DB (entry 46517) (Exploit-DB, Red Hat CVE).

Successful exploitation allows an attacker to create or delete databases, modify schema classes, manage user accounts, and create arbitrary functions within OrientDB — all without the victim's knowledge. These actions can result in data loss, unauthorized privilege escalation within the application, and integrity compromise of the database. While confidentiality and availability impacts are rated as none in the CVSS v3.1 scoring, the integrity impact and potential for cascading damage through malicious function creation or user manipulation should not be underestimated (Feedly, Red Hat CVE).

A proof-of-concept exploit is publicly available on Exploit-DB (entry 46517), though there is no current evidence of active in-the-wild exploitation. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Exploit-DB, Feedly).

1. Reconnaissance: Identify OrientDB 3.0.17 instances exposed via their web interface (default port 2480), using tools like Shodan or Censys to locate internet-facing deployments.
2. Identify target user: Determine an authenticated OrientDB user (e.g., an administrator) whose session can be leveraged for the CSRF attack.
3. Craft malicious request: Construct a forged HTTP request targeting a state-changing endpoint such as POST /database/<dbname> (to create/delete a database) or POST /command/<dbname>/sql (to execute SQL commands), without requiring a CSRF token.
4. Deliver payload via XSS or social engineering: Either exploit a stored/reflected XSS vulnerability in the OrientDB web interface to inject a script that auto-submits the forged request, or craft a malicious external web page that triggers the request when visited by the authenticated victim.
5. Achieve unauthorized action: The victim's browser sends the forged request with their valid session credentials, causing OrientDB to execute the attacker-specified operation — such as creating a new admin user, deleting a database, or injecting a malicious server-side function (Exploit-DB, Feedly).

• Network: Unexpected HTTP POST requests to OrientDB endpoints (/database/, /command/, /document/) originating from browser sessions, particularly from unusual source IPs or at unusual times.
• Logs: OrientDB access logs showing database creation/deletion or schema modification operations not initiated by known administrative workflows; repeated requests to sensitive endpoints with no corresponding user activity in the UI.
• Application: Unexpected new database users or admin accounts appearing in OrientDB; newly created server-side functions with suspicious names or content; databases created or deleted without a corresponding change management record.
• Web Interface: Evidence of stored XSS payloads in OrientDB web UI fields (e.g., class names, function bodies, or document fields containing <script> tags or encoded JavaScript).

Organizations should upgrade OrientDB beyond version 3.0.17 to a release that includes CSRF token validation on all state-changing endpoints; consult the OrientDB release notes for the specific patched version. As an interim workaround, restrict network-level access to the OrientDB web interface (default port 2480) using firewall rules, allowing only trusted administrative hosts. Additionally, implement input validation and output encoding to mitigate the associated XSS vulnerabilities, and enforce strong authentication mechanisms. Monitor OrientDB logs for unexpected database operations as a detection measure (Red Hat CVE, Feedly).