CVE-2025-0994

Executive Summary

CVE-2025-0994 is a critical deserialization vulnerability in Trimble Cityworks, a web-based asset management and GIS-centric solution. The flaw resides in the software's handling of serialized objects, allowing an authenticated user to trigger remote code execution (RCE) on the underlying Microsoft Internet Information Services (IIS) web server. This vulnerability poses a severe risk to critical infrastructure and municipal systems that rely on Cityworks for managing public assets. Successful exploitation could lead to full server compromise, data exfiltration, and lateral movement within the victim's network.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application (Trimble Cityworks) and its deployment on Microsoft IIS. The attack surface is limited to authenticated users, but the impact is severe due to the potential for server-side code execution.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder or error. Based on the description (authenticated RCE on IIS), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) - authenticated user
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

Estimated CVSS Score: 8.8 (High)

Threat Level: High. The vulnerability is exploitable by authenticated users with low privileges, and the impact is complete compromise of the IIS web server.

Deep Dive & Mechanics

The vulnerability is a classic .NET deserialization flaw. Trimble Cityworks uses serialization to transfer data between the client and server, likely via JSON or binary formatters. The software fails to validate or sanitize the serialized data before deserializing it on the server side.

Attack Flow:

1. Authentication: The attacker must have valid credentials to the Cityworks web application.
2. Crafting Payload: The attacker crafts a malicious serialized object (e.g., using ysoserial.net for .NET gadgets) that, when deserialized, executes arbitrary code.
3. Delivery: The malicious payload is sent to the server via an HTTP request (e.g., POST to a vulnerable endpoint).
4. Deserialization: The IIS worker process deserializes the payload, triggering the gadget chain.
5. Code Execution: The gadget chain executes the attacker's code (e.g., PowerShell reverse shell, command execution) in the context of the IIS application pool.

Root Cause: The use of insecure deserialization methods (e.g., BinaryFormatter, JavaScriptSerializer with a SimpleTypeResolver, or LosFormatter) without proper type validation or a custom SerializationBinder.

Vulnerable vs. Patched Code

The patch likely involves implementing a secure deserialization approach. Below is a conceptual comparison.

Vulnerable Code (C# - Conceptual):

// Vulnerable: Direct deserialization without type validation
public void ProcessRequest(HttpContext context)
{
    string input = new StreamReader(context.Request.InputStream).ReadToEnd();
    BinaryFormatter formatter = new BinaryFormatter();
    // No SerializationBinder set - allows arbitrary types
    object obj = formatter.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(input)));
    // Process obj...
}

Patched Code (C# - Conceptual):

// Patched: Using a custom SerializationBinder to restrict types
public class SafeBinder : SerializationBinder
{
    public override Type BindToType(string assemblyName, string typeName)
    {
        // Only allow specific safe types
        if (typeName.StartsWith("Trimble.Cityworks.SafeTypes,"))
        {
            return Type.GetType($"{typeName}, {assemblyName}");
        }
        else
        {
            throw new SerializationException("Type not allowed");
        }
    }
}

public void ProcessRequest(HttpContext context)
{
    string input = new StreamReader(context.Request.InputStream).ReadToEnd();
    BinaryFormatter formatter = new BinaryFormatter();
    formatter.Binder = new SafeBinder(); // Restrict deserialization
    object obj = formatter.Deserialize(new MemoryStream(Encoding.UTF8.GetBytes(input)));
    // Process obj...
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Target: A Windows Server 2019/2022 with IIS and Trimble Cityworks version 15.8.8 (vulnerable).
2. Attacker: Kali Linux with ysoserial.net and a web proxy (Burp Suite).

Exploitation Steps:

1. Authenticate: Obtain valid credentials for the Cityworks web application.
2. Identify Endpoint: Use Burp Suite to intercept traffic and identify endpoints that accept serialized data (e.g., /Cityworks/Desktop/DesktopService.asmx or similar).
3. Generate Payload: Use ysoserial.net to generate a payload for a .NET gadget chain (e.g., TextFormattingRunProperties, PSObject, or ActivitySurrogateSelector).

   # Example: Generate a PowerShell reverse shell payload
   ysoserial.exe -o raw -g TextFormattingRunProperties -f BinaryFormatter -c "powershell -e <base64_encoded_rev_shell>"
   

4. Send Payload: Send the payload in the HTTP request body to the vulnerable endpoint.
5. Trigger: The server deserializes the payload, executing the command.
6. Receive Shell: The attacker receives a reverse shell on their listener.

Example Request (Burp Suite):

POST /Cityworks/Desktop/DesktopService.asmx HTTP/1.1
Host: target.cityworks.local
Content-Type: application/x-www-form-urlencoded
Cookie: .ASPXAUTH=<valid_auth_cookie>

<binary_payload_from_ysoserial>

Blue Team

Detection & Response:

1. Monitor IIS Logs: Look for unusual POST requests to .asmx or .svc endpoints with abnormally large payloads.
2. Enable .NET Deserialization Logging: Use ETW (Event Tracing for Windows) to log deserialization events.

   # Enable .NET deserialization logging
   wevtutil sl "Applications and Services Logs/Microsoft/Windows/CodeIntegrity/Operational" /e:true
   

3. Deploy RASP: Use a Runtime Application Self-Protection (RASP) tool to block deserialization attacks.
4. Harden IIS: Ensure the application pool runs with minimal privileges (ApplicationPoolIdentity). Disable unnecessary IIS modules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /Cityworks/Desktop/DesktopService.asmx or similar endpoints with binary or base64-encoded payloads.
  • Outbound connections to unknown IPs on high ports (e.g., 4444, 9001) from the IIS server.
• File IOCs:
  • Suspicious files in C:\Windows\Temp\ or C:\inetpub\wwwroot\Cityworks\App_Data\ (e.g., .ps1, .exe, .dll).
  • Modified web.config files with unsafe deserialization settings.
• Process IOCs:
  • w3wp.exe spawning child processes like cmd.exe, powershell.exe, or rundll32.exe.
  • Unusual network connections from w3wp.exe.
• Registry IOCs:
  • Changes to HKLM\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\ (e.g., SchUseStrongCrypto).

Detection Engineering

YARA Rule

rule CVE_2025_0994_Deserialization_Payload {
    meta:
        description = "Detects potential CVE-2025-0994 deserialization payloads in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0994"
    strings:
        $binary_formatter = { 00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00 }
        $text_formatting_run = { 54 65 78 74 46 6F 72 6D 61 74 74 69 6E 67 52 75 6E 50 72 6F 70 65 72 74 69 65 73 }
        $ps_object = { 50 53 4F 62 6A 65 63 74 }
        $activity_surrogate = { 41 63 74 69 76 69 74 79 53 75 72 72 6F 67 61 74 65 53 65 6C 65 63 74 6F 72 }
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-0994 - Trimble Cityworks Deserialization RCE
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-0994 via IIS logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '*/DesktopService.asmx*'
            - '*/CityworksService.svc*'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate Cityworks API calls
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0994 - Trimble Cityworks Deserialization RCE"; flow:to_server,established; content:"POST"; http_method; content:"/DesktopService.asmx"; http_uri; content:"|00 01 00 00 00 FF FF FF FF|"; within:100; reference:cve,2025-0994; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to Cityworks 15.8.9 or later, or Cityworks with Office Companion 23.10 or later.
2. Workaround: If patching is not possible, restrict access to the Cityworks web application to trusted IPs only. Disable the vulnerable endpoints (e.g., DesktopService.asmx) if not required.
3. IIS Hardening:
   • Set the application pool identity to ApplicationPoolIdentity with minimal permissions.
   • Enable Dynamic IP Restrictions in IIS.
   • Disable unnecessary HTTP methods (e.g., PUT, DELETE).

Long-Term Mitigations:

1. Code Review: Implement secure deserialization practices (e.g., SerializationBinder, DataContractSerializer).
2. WAF Rules: Deploy a Web Application Firewall (WAF) with rules to block known deserialization payloads.
3. Monitoring: Continuously monitor IIS logs and .NET ETW events for suspicious deserialization activity.
4. Network Segmentation: Place the Cityworks server in a segmented network with strict egress controls.

Valters IT
Securing Digital Infrastructure