CTFd <=3.7.6 MITM Vuln (CVE-2025-29419): Missing HTTPS/HSTS causes plaintext leak

CVE-2025-29419: Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: CVE-2025-29419 — Man-in-the-Middle (MITM) Vulnerability in CTFd ≤ 3.7.6 Vulnerability Type: Adjacent Network Attack Severity: High (CVSS v3.1 Score 7.3) Core Issue: CTFd version 3.7.6 and earlier do not enforce HTTPS or HTTP Strict Transport Security (HSTS), allowing attackers within the same network segment to perform man-in-the-middle attacks. This enables the interception of session tokens, administrator credentials, API tokens, and flag submissions and other sensitive data. Scope of Impact Affected Product: CTFd Affected Versions: ≤ 3.7.6 Affected Components: - Transport Layer: HTTPS not enforced, no HSTS - Response Headers: Missing header - Sensitive Data Exposure: Session cookies, administrator credentials, API tokens, and POST request bodies (flag submissions) are transmitted in plaintext Attack Scenarios The attacker must be on the same network segment as CTFd (e.g., LAN or shared Wi-Fi). The attack chain is as follows: 1. ARP Spoofing / MITM Setup: Use or to position the attacker between the victim and the CTFd server. 2. Traffic Interception: Because CTFd does not enforce HTTPS and HSTS is not configured, the victim's browser communicates via plaintext HTTP. 3. SSL Stripping: When the victim attempts HTTPS, the lack of HSTS allows the attacker to downgrade the connection to HTTP. 4. Credential and Token Harvesting: Session tokens, API keys, administrator login credentials, and flag submissions in POST request bodies are captured in plaintext. Remediation Upgrade to a version later than v3.7.6 (v3.7.6 has been deployed for hosted CTFd clients) Self-Hosted Users: Download the latest version of CTFd from GitHub. Mitigation Measures: - Configure a reverse proxy (such as nginx or Apache2) to enforce HTTPS and set the HSTS header. - Set to mitigate Host header injection (introduced in v3.7.6). - Note: only partially addresses Host header injection and does not resolve the core issues of missing HTTPS enforcement and HSTS. Exploitation Tools (PoC) Timeline

Goal Reached Thanks to every supporter — we hit 100%!

CTFd <=3.7.6 MITM Vuln (CVE-2025-29419): Missing HTTPS/HSTS causes plaintext leak