RBI Assistant Platform CVE-2025-62647

No vendor-released patch with an identifiable version number has been published; the remediation is a server-side authorization fix, and operators of the platform should assume the vulnerable behavior persists until RBI confirms otherwise. The correct fix is to bind every signed-upload-URL request to the store scope asserted by the presented JWT, rejecting any request whose target path falls outside the caller's authorized store identifier, and to treat the returned token as conferring only that store's scope rather than platform-wide upload rights. If the vendor cannot immediately deploy that check, effective compensating controls include: revoking and rotating the JWT signing key so previously issued tokens are invalidated (side effect: legitimate clients must re-authenticate); disabling or tightly rate-limiting the presigned-URL minting endpoint until authorization logic is corrected (side effect: breaks legitimate upload workflows); and enforcing S3 bucket policies or IAM conditions that restrict each credential's PutObject rights to a single store prefix so a mis-issued URL cannot write outside its intended path (side effect: requires mapping each store to distinct credentials and may complicate shared tooling). Validation of store path ownership should also be added at the object-storage layer to catch authorization mistakes upstream. References for further detail include the researcher write-up at https://bobdahacker.com/blog/rbi-hacked-drive-thrus/ and the coverage at https://www.malwarebytes.com/blog/news/2025/09/popeyes-tim-hortons-burger-king-platforms-have-catastrophic-vulnerabilities-say-hackers.