CVE-2025-32367: Personal Identifiable Information Retrieval in Oz Forensics Face Recognition Application

Overview

The vulnerability discussed in this post, labeled as CVE-2025-32367, affects the Oz Forensics face recognition application version prior to 4.0.8. This particular vulnerability can lead to unauthorized retrieval of personally identifiable information (PII). Any organization that uses this face recognition application in its security infrastructure should be aware of this vulnerability, as it could potentially lead to serious data leakage and system compromise. This issue is of great concern due to the possible violations of privacy regulations and the potential financial and reputational damage that could result from such violations.

Vulnerability Summary

CVE ID: CVE-2025-32367
Severity: High (8.6)
Attack Vector: Network
Privileges Required: Low
User Interaction: None
Impact: Unauthorized retrieval of PII leading to possible system compromise or data leakage

Affected Products

Product | Affected Versions

Oz Forensics face recognition application | Versions prior to 4.0.8

How the Exploit Works

This vulnerability exploits an Insecure Direct Object Reference (IDOR) within the /statistic/list endpoint. An attacker can manipulate parameters that reference objects directly in order to gain unauthorized access to data. In this case, an attacker can potentially manipulate the IDOR to retrieve PII from the application without the necessary permissions. The application fails to properly verify the user’s authorization before granting access to the requested data, thus enabling the exploit.

Conceptual Example Code

Here’s a conceptual example of how the vulnerability might be exploited in an HTTP request:

GET /statistic/list?id=1234 HTTP/1.1
Host: vulnerable.example.com

In this example, an attacker could manipulate the ‘id’ parameter to access data of other users. For instance, changing ‘id=1234’ to ‘id=5678’ might allow access to another user’s personal data.

Mitigation Guidance

Users are advised to immediately update the Oz Forensics face recognition application to the latest version. Although the version number remains the same (4.0.8), the vendor has released a patch to mitigate this vulnerability. In cases where immediate patching is not possible, deploying a web application firewall (WAF) or intrusion detection system (IDS) to detect and block attempts to exploit this vulnerability can serve as a temporary mitigation measure.