External risk intelligence

Passy Command Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-67397

The vulnerability involves command execution via crafted HTTP requests in the Passy application. While the attack vector is network-based, the vulnerability requires authentication. The product is a web-based application, which makes it plausibly reachable from the internet in some deployments, but the context does not establish that public-facing exposure is a standard or required configuration for this specific service.

Passy

1.6.3

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a critical vulnerability in the Passy application, specifically version 1.6.3. The issue allows authenticated attackers to execute arbitrary commands through a specially crafted network request. While the vulnerability requires authentication, its critical severity and potential for command execution warrant attention to confirm relevance and exposure within our environment.

Attackers can run unauthorized commands.
Critical flaw impacts the Passy application.
Confirm if Passy is used and exposed.

Attack Path

How an attacker could exploit the issue

An attacker who has already logged into the Passy application can send a specially crafted HTTP request. This request exploits a vulnerability to inject commands, allowing the attacker to run arbitrary code on the system where Passy is running.

Attacker must be authenticated.
Send a crafted HTTP request.
Allows arbitrary command execution.

Live Threat

Current exploitation, exposure, and threat context

A remote authenticated attacker could execute arbitrary commands by sending a specially crafted HTTP request to Passy version 1.6.3, potentially impacting the confidentiality, integrity, and availability of the affected system when this specific payload injection is supported.

System command execution.
Crafted HTTP request.
Compromise of system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Passy application's command injection vulnerability requires authenticated access, but its network-exploitable nature means multiple teams could be involved in its management. Application owners are responsible for Passy itself, while infrastructure or platform teams likely manage the underlying servers and network access. Security teams will be involved in assessing exposure and coordinating remediation. The first practical step is to identify all Passy instances, determine their reachability and criticality, and then assign ownership for a planned remediation, potentially involving coordination with the vendor if the product is procured externally.

Application and platform teams own remediation.
Verify Passy instance reachability and criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Passy application?

Passy is a web-based software application used for specialized data management or administrative tasks. It operates as a service that listens for HTTP requests, meaning it is designed to handle web traffic to provide its core functionality to users.

What does CWE-77 mean for CVE-2025-67397?

CWE-77 refers to improper neutralization of special elements used in a command, commonly known as command injection. In the context of this CVE, it means the application fails to properly sanitize user input in HTTP requests, allowing an attacker to insert and run their own system-level commands instead of the intended software functions.

How is this command injection triggered?

An attacker triggers this by sending a specifically formatted HTTP request containing a malicious payload to the application. This vulnerability does not trigger through standard, benign usage; it requires the attacker to possess valid credentials to authenticate successfully before they can submit the crafted request.

Do I need to worry if Passy is internal?

Halo Surface Signal notes that while this is a network-based vulnerability, it requires authentication, which limits the immediate risk to unauthenticated internet users. However, if your instance of Passy is reachable over a network, an attacker with valid credentials—or a compromised account—could leverage this flaw, making internal reachability a factor in your risk assessment.

When should I prioritize fixing this flaw?

Prioritize this by first identifying all active instances of Passy version 1.6.3 in your environment. Once identified, evaluate who has access to these instances and coordinate with the relevant application or infrastructure owners to confirm the system's role, manage access controls, and plan for necessary updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.