Overview
The Common Vulnerabilities and Exposures (CVE) system has identified a severe vulnerability, CVE-2025-52572, affecting all versions of the popular Telegram userbot, Hikka. This vulnerability has the potential to compromise entire systems and leak sensitive data, making it a pressing concern for all Hikka users. With a CVSS severity score of 10.0, the maximum possible, it represents a significant threat to the security and privacy of users and their data.
The vulnerability lies in the Hikka bot’s web interface and can be exploited in two distinct scenarios. The first scenario occurs when the web interface lacks an authenticated session, allowing an attacker to use their Telegram account to gain remote code execution (RCE) to the server. The second scenario involves an authenticated session, where a lack of sufficient warning in the authentication message tempts users to allow potentially damaging actions.
Vulnerability Summary
CVE ID: CVE-2025-52572
Severity: Critical (10.0 CVSS Score)
Attack Vector: Network
Privileges Required: None
User Interaction: Required
Impact: System compromise and data leakage
Affected Products
Product | Affected Versions
Hikka (Telegram Userbot) | All Versions
How the Exploit Works
The exploit takes advantage of flaws in Hikka’s web interface. In the first scenario, if the interface lacks an authenticated session, an attacker can use their Telegram account to authorize in the dangling web interface and gain RCE to the server. In the second scenario, with an authenticated session, an attacker can manipulate users into allowing potentially harmful actions due to insufficient warning in the authentication message. This not only enables RCE but also grants the attacker access to the Telegram accounts of the owners.
Conceptual Example Code
Given the nature of this vulnerability, a conceptual example would involve an attacker using their own Telegram account to authorize in the dangling web interface of an unsecured Hikka userbot. This could potentially look something like this:
import telebot
bot = telebot.TeleBot('YOUR_BOT_TOKEN')
@bot.message_handler(commands=['start'])
def send_welcome(message):
bot.reply_to(message, "Hello, I am the attacker's bot. You just allowed me to execute remote code on your server.")
bot.polling()In this conceptual example, the attacker’s bot sends a welcome message to the user, indicating that the user has unknowingly given the bot permission to execute remote code. The actual exploit would be far more complex and malicious, but this provides a basic idea of how the vulnerability could be exploited.
