CVE-2025-9604 in coze-studio
Summary
by MITRE • 08/29/2025
A vulnerability was identified in coze-studio up to 0.2.4. The impacted element is an unknown function of the file backend/domain/plugin/encrypt/aes.go. The manipulation of the argument AuthSecretKey/StateSecretKey/OAuthTokenSecretKey leads to use of hard-coded cryptographic key . It is possible to initiate the attack remotely. The attack is considered to have high complexity. The exploitability is regarded as difficult. To fix this issue, it is recommended to deploy a patch. The vendor replied to the GitHub issue (translated from simplified Chinese): "For scenarios requiring encryption, we will implement user-defined key management through configuration and optimize the use of encryption tools, such as random salt."
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/29/2025
The vulnerability identified in coze-studio version 0.2.4 represents a critical cryptographic weakness that undermines the security of sensitive data handling within the application's backend infrastructure. This flaw resides within the file backend/domain/plugin/encrypt/aes.go and specifically targets the authentication and state management components that rely on hard-coded cryptographic keys for encryption operations. The affected parameters AuthSecretKey, StateSecretKey, and OAuthTokenSecretKey are all susceptible to manipulation through external inputs, creating a pathway for attackers to compromise the encryption mechanisms that should protect confidential information. The vulnerability's classification as remotely exploitable indicates that adversaries can target this weakness without requiring physical access to the system, making it particularly dangerous in networked environments where the application is exposed to external threats.
The technical implementation of this vulnerability stems from the application's reliance on hardcoded cryptographic keys rather than dynamic key management systems. When an attacker can manipulate the AuthSecretKey, StateSecretKey, or OAuthTokenSecretKey arguments, they effectively gain access to the encryption keys that protect sensitive data flows within the application. This represents a direct violation of cryptographic best practices and security standards such as those outlined in CWE-327, which specifically addresses the use of weak or hardcoded cryptographic keys. The high complexity rating and difficult exploitability classification suggest that while the vulnerability exists, attackers must possess significant technical expertise to successfully leverage it, potentially requiring knowledge of the specific code structure and timing attacks to bypass potential protections. The attack vector being remote means that threat actors can target this vulnerability from outside the local network, amplifying the potential impact across a wider attack surface.
The operational impact of this vulnerability extends beyond simple data exposure, as it fundamentally compromises the integrity and confidentiality of authentication tokens, state management information, and OAuth integration components that rely on the affected encryption mechanisms. This weakness creates opportunities for attackers to perform session hijacking, impersonate legitimate users, and potentially escalate privileges within the application ecosystem. The vulnerability's presence in the plugin encryption module suggests that the entire plugin architecture may be at risk, potentially affecting multiple security controls that depend on proper cryptographic implementation. Organizations using this version of coze-studio face significant risks including unauthorized access to user sessions, exposure of sensitive configuration data, and potential lateral movement within their infrastructure if the application is part of larger networked systems. The vulnerability's impact is further exacerbated by the fact that it affects core authentication and state management functions that are fundamental to the application's security posture.
Vendor response to this vulnerability demonstrates an understanding of the security implications, with the development team acknowledging the need for improved key management through configurable user-defined encryption keys and the implementation of random salt mechanisms. This approach aligns with industry best practices and ATT&CK framework techniques that emphasize proper cryptographic key management and the elimination of hardcoded secrets. The recommended solution involves moving away from static key implementations toward dynamic key generation and configuration management systems that can be updated without requiring complete application redeployment. Security teams should implement immediate mitigations including patching the application to version 0.2.5 or later, reviewing existing encryption key configurations, and implementing monitoring for unauthorized access attempts to the affected components. Organizations should also consider implementing additional security controls such as network segmentation, intrusion detection systems, and regular security assessments to protect against potential exploitation of this vulnerability while awaiting official patches. The remediation process should include thorough testing of the updated encryption implementation to ensure that the new key management approach properly addresses the root cause of the vulnerability without introducing new security weaknesses.