CVE-2025-13315, CVE-2025-13316 Critical Twonky Server Authen...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed
• Blog Title: CVE-2025-13315, CVE-2025-13316: Critical Twonky Server Authentication Bypass (NOT FIXED)
• Suggested Section: Pentesting Web -> Web Vulnerabilities Methodology (subsection on routing/path-prefix based authentication bypass and reversible 'encrypted' credentials using hardcoded symmetric keys)

🎯 Content Summary

Scope & Impact
Twonky Server 8.5.2 (latest version at time of research) on Linux (e.g., Ubuntu 22.04.1) and Windows (e.g., Windows Server 2022) is affected by two chained vulnerabilities that give an unauthenticated remote attacker access to administrator credentials and full web admin control. CVE-2025-13315 (CVSS 9.3, Critical) allows authentication bypass of specific RPC web API endpoints via an alternate routing prefix, enabling leakage of logs that contain encrypted admin cred...

🔧 Technical Details

Routing-based auth bypass via alternate /nmc/rpc prefix
The core trick is to abuse Twonky’s dual routing prefixes. Admin RPC handlers (e.g., log_getfile, stop) are protected when accessed under /rpc, but the same handler logic is also reachable under /nmc/rpc without the same auth checks. An attacker sends unauthenticated HTTP requests like GET /nmc/rpc/log_getfile to download the entire application log. Because Twonky logs the accessuser and encrypted accesspwd at startup, the log file itself becomes a credential leak source. This generalizes to any environment where alternate routing paths are not covered by auth middleware.

Reversible password encryption via static Blowfish key table
The second trick exploits a flawed symmetric encryption scheme. Twonky’s enc_passwd function chooses an index 0–11, looks up a corresponding Blowfish key from a co...

🤖 Agent Actions

Summary:

• Enhanced web-vulnerabilities-methodology.md with a new subsection describing routing/path-prefix based authentication bypasses, using Twonky Server’s /nmc/rpc/* exposure to outline exploitation workflow and defensive monitoring tips.
• Added guidance on recovering “encrypted” credentials protected by globally hardcoded Blowfish keys, including the Twonky key table, decryption steps, and mitigation advice.
• Documented the Rapid7 research source in a new References section.

Tests: Not run (not requested).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.rapid7.com/blog/post/cve-2025-13315-cve-2025-13316-critical-twonky-server-authentication-bypass-not-fixed

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web -> Web Vulnerabilities Methodology (subsection on routing/path-prefix based authentication bypass and reversible 'encrypted' credentials using hardcoded symmetric keys)".

Repository Maintenance:

• MD Files Formatting: 913 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0