CVE-2025-56333: 
NixOS vulnerability analysis and mitigation

CVE-2025-56333 is an improper authentication vulnerability in Fossorial fosrl/pangolin (versions 1.6.2 and earlier) that allows remote, unauthenticated attackers to bypass PIN-based resource authentication and two-factor authentication (2FA) via an insecure default rate-limiting configuration. The vulnerability was discovered on 2025-07-10, the vendor was notified on 2025-07-13, remediation was completed on 2025-07-18, and public disclosure occurred on 2025-12-24. It affects all pangolin deployments prior to version 1.7.0. The CVSS v3.1 base score is 9.8 (Critical) (Feedly, PoC Gist).

The root cause is CWE-287 (Improper Authentication), specifically an insecure default in the authentication rate-limiting middleware. The authRouter applies a global rate limit (500 requests per minute per IP+path) as a fallback when no auth-specific rate limit is configured — a condition that occurs in virtually all deployments because the official installer never sets rate_limits.auth and the parameter is undocumented. The /resource/:resourceId/pincode endpoint (6-digit PIN, 1,000,000 combinations) and the /login endpoint (6-digit TOTP) both fall through to this permissive global limit, enabling brute-force attacks that can exhaust all possible codes in approximately 33 hours at 500 attempts/minute — or faster with IP rotation. No authentication, special privileges, or user interaction is required to exploit this over the network (PoC Gist).

Successful exploitation allows a remote attacker to bypass PIN-based resource access controls and 2FA protections, effectively escalating privileges to gain full access to protected resources and administrative accounts. The CVSS assessment reflects high impact to confidentiality, integrity, and availability — an attacker who bypasses 2FA on an admin account can fully compromise the pangolin instance, including all tunneled resources, connected sites, and user data. Given pangolin's role as an identity-aware VPN and reverse proxy, compromise could enable lateral movement into all private networks and resources exposed through the platform (PoC Gist, Feedly).

A public proof-of-concept write-up is available as a GitHub Gist published on 2025-12-24, detailing the attack mechanics and affected code paths (PoC Gist). The EPSS score is approximately 0.144%, indicating a relatively low (but non-negligible) probability of exploitation in the wild in the near term. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The low barrier to exploitation — no authentication, no user interaction, network-accessible — makes it a realistic target for opportunistic attackers against internet-facing pangolin deployments (Feedly).

1. Reconnaissance: Identify internet-facing pangolin instances (versions < 1.7.0) using Shodan, Censys, or similar tools by searching for pangolin's default web interface or API endpoints.
2. Target PIN-protected resource: Send repeated POST requests to /resource/:resourceId/pincode with sequentially or randomly generated 6-digit PIN codes. The global rate limit of 500 requests/minute per IP+path allows exhausting all 1,000,000 combinations in approximately 33 hours without triggering a lockout.
3. Accelerate with IP rotation: Use a pool of proxies or rotating IPs to multiply the effective request rate, significantly reducing the time to brute-force the PIN.
4. Target 2FA bypass: Alternatively, after obtaining valid credentials (e.g., via credential stuffing or phishing), send repeated POST requests to /login with the correct username/password and sequentially generated 6-digit TOTP codes. The same permissive global rate limit applies, allowing TOTP brute-force within the ~30-second TOTP validity window if request rates are high enough, or across multiple windows with IP rotation.
5. Gain privileged access: Upon guessing the correct PIN or TOTP code, the attacker gains access to the protected resource or authenticated session, potentially with administrative privileges, enabling full platform compromise (PoC Gist).

• Network: High volume of POST requests to /resource/:resourceId/pincode or /login endpoints from a single IP or a rotating set of IPs; sequential or random 6-digit numeric values in request bodies.
• Logs: Application logs showing hundreds of failed authentication attempts per minute against the same resource or login endpoint; successful authentication following a large number of failures from the same or nearby IPs.
• Logs: If app.log_failed_attempts is enabled in config, repeated log entries such as Username or password incorrect from the same IP or user agent.
• Process/Behavior: Unexpected successful logins or resource access events immediately following a burst of failed attempts; new sessions established from unfamiliar geographic locations or IP ranges after a brute-force pattern (PoC Gist).

Upgrade to pangolin version 1.7.0 or later, which remediates the insecure default rate-limiting configuration for authentication endpoints (PoC Gist, Pangolin GitHub). As an interim workaround for deployments that cannot immediately upgrade, manually configure rate_limits.auth in the pangolin configuration to enforce a strict per-IP limit on authentication endpoints (e.g., 5–10 requests per 15 minutes). Additionally, restrict network-level access to the pangolin web interface to trusted IP ranges and monitor authentication logs for brute-force patterns.