CVE-2025-24369: 
Linux openSUSE vulnerability analysis and mitigation

Anubis, a tool designed to protect against AI scrapers through bot-checking heuristics and proof-of-work challenges, was found to contain a security vulnerability (CVE-2025-24369) that was disclosed on January 26, 2025. The vulnerability allowed attackers to bypass bot protection by requesting a challenge, formulating any nonce (such as 42069), and then passing the challenge with difficulty zero (GitHub Advisory, NVD).

The vulnerability stems from a design flaw where the server relied on client-specified difficulty values when making allow/deny decisions. The issue was classified as CWE-807: Reliance on Untrusted Inputs in a Security Decision. The vulnerability received a CVSS v4.0 score of 2.3 (LOW) with the vector string CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N, indicating network accessibility with high attack complexity (GitHub Advisory).

The vulnerability allowed sophisticated attackers or scraper runners targeting websites using Anubis to bypass the bot protection mechanisms. However, the impact was considered low as it required a targeted attack, and according to the developer, the only known instances of exploitation were during proof of concept testing by the reporter and the developer's own testing (Xe Blog).

The vulnerability was fixed in version v1.11.0-37-gd98d70a through commit e09d0226a628f04b1d80fd83bee777894a45cd02, which modified the system to use administrator-configured difficulty values instead of client-specified ones. Users are advised to pull the most recent Docker image to ensure they have the patched version. No workarounds are available, and users must upgrade to fix the issue (GitHub Advisory).

The vulnerability was responsibly disclosed by security researcher Coral Pink, and the developer (Xe Iaso) responded with transparency by publishing a detailed blog post explaining the vulnerability, its impact, and the fixes implemented. The developer also emphasized their commitment to handling security issues professionally and honestly (Xe Blog).