CVE-2025-23222: dde-api-proxy: Authentication Bypass in Deepin D-Bus Proxy Service (CVE-2025-23222)
First published: Fri Jan 24 2025(Updated: )
An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Deepin dde-api-proxy | <=1.0.19 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-23222?
CVE-2025-23222 has been assigned a high severity level due to its potential for privilege escalation.
How do I fix CVE-2025-23222?
To fix CVE-2025-23222, update Deepin dde-api-proxy to version 1.0.20 or later.
Who is affected by CVE-2025-23222?
CVE-2025-23222 affects users of Deepin dde-api-proxy versions up to and including 1.0.19.
What type of vulnerability is CVE-2025-23222?
CVE-2025-23222 is a privilege escalation vulnerability that allows unprivileged users to access D-Bus services as root.
Can CVE-2025-23222 be exploited remotely?
No, CVE-2025-23222 requires local access to exploit, as it involves interactions with local D-Bus services.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-23222
- agent/title
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/weakness
- agent/last-modified-date
- agent/author
- agent/source
- agent/tags
- agent/trending
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- vendor/deepin
- canonical/deepin dde-api-proxy