CVE-2025-11939

Executive Summary

CVE-2025-11939 is a path traversal vulnerability in ChurchCRM versions up to 5.18.0, specifically within the Backup Restore Handler component (src/ChurchCRM/Backup/RestoreJob.php). An authenticated attacker can manipulate the restoreFile argument to traverse directories and potentially read or write arbitrary files on the server. The vulnerability has a CVSS score of 4.7 (Medium), and while the EPSS score is currently 0.0%, the exploit has been publicly disclosed, increasing the risk of active exploitation. No official patch is available as the vendor has not responded to disclosure attempts.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). ChurchCRM is a standalone PHP application. The risk is to self-hosted instances.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): Low (L) - Requires authenticated access.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited file read.
• Integrity (I): Low (L) - Limited file write.
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the immediate risk, but the public availability of exploit details and the lack of a patch make this a significant threat for ChurchCRM administrators.

Deep Dive & Mechanics

The vulnerability resides in the backup restore functionality. The RestoreJob.php file processes the restoreFile parameter without proper sanitization. By injecting path traversal sequences (e.g., ../), an attacker can escape the intended backup directory and access or overwrite arbitrary files on the server.

Root Cause: The application fails to validate or sanitize the restoreFile input, allowing directory traversal. The code likely uses the user-supplied value directly in file operations like file_get_contents(), file_put_contents(), or unlink().

Attack Scenario:

1. An attacker authenticates to the ChurchCRM web interface.
2. The attacker crafts a malicious request to the restore endpoint, setting the restoreFile parameter to something like ../../../../etc/passwd.
3. The server processes the request and reads or writes the targeted file.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state. A patched version would need to implement proper input validation.

Vulnerable Code (Conceptual):

// src/ChurchCRM/Backup/RestoreJob.php
$restoreFile = $_POST['restoreFile'];
$filePath = '/var/backups/' . $restoreFile;
$content = file_get_contents($filePath);

Patched Code (Conceptual):

// src/ChurchCRM/Backup/RestoreJob.php
$restoreFile = basename($_POST['restoreFile']);
$allowedPath = realpath('/var/backups/');
$filePath = realpath($allowedPath . '/' . $restoreFile);
if (strpos($filePath, $allowedPath) !== 0) {
    die('Invalid file path.');
}
$content = file_get_contents($filePath);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for a ChurchCRM user.
• Network access to the ChurchCRM instance.

Exploit Steps:

1. Log in to ChurchCRM.
2. Identify the restore endpoint (e.g., /api/backup/restore or similar).
3. Send a POST request with the restoreFile parameter containing path traversal payloads.

Example Request (using cURL):

curl -X POST \
  -c cookies.txt -b cookies.txt \
  -d "restoreFile=../../../../etc/passwd" \
  http://target.churchcrm.local/api/backup/restore

Expected Output: The server will return the contents of /etc/passwd or another targeted file.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual file access patterns in web server logs.
• Look for requests to the restore endpoint with suspicious restoreFile parameters containing ../ sequences.
• Use file integrity monitoring (FIM) to detect unauthorized changes to critical system files.

Response:

1. Immediately isolate the affected server.
2. Review web server logs for the source IP and scope of the attack.
3. Check for any modified or exfiltrated files.
4. If possible, temporarily disable the restore functionality.
5. Apply the conceptual patch or implement a WAF rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /api/backup/restore or similar endpoints with restoreFile parameter containing ../ or ..\.
  • Outbound connections from the server to unknown IPs (potential data exfiltration).
• File System:
  • Unexpected files in the backup directory.
  • Modified system files (e.g., /etc/passwd, /etc/shadow).
  • Presence of web shells in web-accessible directories.
• Logs:
  • Web server logs showing 200 responses to path traversal requests.
  • Application logs showing errors related to file operations outside the backup directory.

Detection Engineering

YARA Rule

rule CVE_2025_11939_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting ChurchCRM RestoreJob.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11939"
    strings:
        $s1 = "restoreFile" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
        $s4 = "/etc/passwd" nocase
        $s5 = "RestoreJob.php" nocase
    condition:
        any of ($s1, $s5) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-11939 ChurchCRM Backup Restore Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in ChurchCRM backup restore functionality
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-11939
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'restoreFile'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/passwd'
            - '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate backup file names containing dots (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11939 ChurchCRM Backup Restore Path Traversal";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"restoreFile"; http_client_body;
    content:"../"; http_client_body; distance:0;
    sid:1000001;
    rev:1;
    reference:cve,2025-11939;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Backup Restore: If the restore functionality is not critical, disable it by removing or renaming RestoreJob.php.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing path traversal patterns in the restoreFile parameter.
3. Input Validation: Implement server-side validation to ensure the restoreFile parameter contains only alphanumeric characters and dots (e.g., [a-zA-Z0-9._-]+).

Long-Term Fix:

• Apply the conceptual patch provided in the "Vulnerable vs. Patched Code" section.
• Monitor the ChurchCRM project for an official patch.
• Consider migrating to a different church management solution if the vendor remains unresponsive.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.