CVE-2025-20002

Executive Summary

CVE-2025-20002 is a local path information disclosure vulnerability in GMOD Apollo, a file upload component for Garry's Mod. When a user attempts to upload a file that does not meet the server's prerequisites (e.g., invalid file type, size, or content), the application responds with an error message that includes the full local file system path where the file was processed. This leakage of internal server paths can aid attackers in reconnaissance, enabling them to map the server's directory structure and potentially identify other vulnerable components or configuration files. No CVSS score, EPSS score, or patch information is currently available. The vulnerability is publicly known but lacks a formal patch.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): None (likely)
• User Interaction (UI): Required (file upload attempt)
• Scope (S): Unchanged
• Confidentiality (C): Low (path disclosure)
• Integrity (I): None
• Availability (A): None
• Threat Level: Low to Medium (information disclosure only, but can enable further attacks)

Deep Dive & Mechanics

The vulnerability resides in the error handling logic of GMOD Apollo's file upload functionality. When a client sends a file upload request, the server validates the file against a set of prerequisites (e.g., allowed extensions, maximum size, MIME type). If validation fails, the server constructs an error response that inadvertently includes the absolute file system path of the temporary upload directory or the target storage path. This path is typically derived from server-side variables like $_FILES['file']['tmp_name'] or a hardcoded path in the application's configuration.

The disclosure occurs because the error message is generated using a string concatenation or template that includes the path variable without sanitization. For example, an error like "File upload failed: /var/www/html/uploads/tmp/phpXXXXXX is not a valid image" reveals the server's directory structure. An attacker can exploit this by sending multiple upload attempts with different invalid files to map the server's file system.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual PHP):

if (!in_array($fileType, $allowedTypes)) {
    die("Error: File $filePath is not allowed.");
}

Patched Code (Conceptual PHP):

if (!in_array($fileType, $allowedTypes)) {
    die("Error: File upload failed due to invalid type.");
}

The patched version removes the $filePath variable from the error message, preventing path disclosure.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a local instance of GMOD Apollo (vulnerable version) on a web server (e.g., Apache/Nginx with PHP).
2. Reconnaissance: Use a tool like Burp Suite or curl to send a file upload request with an invalid file (e.g., a .exe file when only images are allowed).
3. Exploit: Observe the response for path disclosure.

   curl -F "file=@malicious.exe" http://target.com/upload.php
   

   Response: Error: /var/www/html/uploads/tmp/phpABCDEF.exe is not allowed.
4. Mapping: Repeat with different file types and sizes to map the directory structure.

Blue Team

1. Detection: Monitor web server logs for repeated file upload attempts with invalid files, especially those that trigger error responses containing path information.
2. Mitigation: Implement generic error messages that do not include file paths. Use a whitelist of allowed file types and sizes.
3. Hardening: Ensure the web server's document root does not expose sensitive directories. Use a dedicated upload directory with restricted permissions.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /upload.php or similar endpoints with invalid file types.
• Logs: Error messages in server logs containing absolute file paths (e.g., /var/www/html/, /tmp/).
• File: Temporary files in /tmp/ or upload directories with unusual names (e.g., phpXXXXXX).

Detection Engineering

YARA Rule

rule CVE_2025_20002_Path_Disclosure {
    meta:
        description = "Detects path disclosure in GMOD Apollo error responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-20002"
    strings:
        $path1 = "/var/www/html/" ascii wide nocase
        $path2 = "/tmp/" ascii wide nocase
        $path3 = "/home/" ascii wide nocase
        $error = "Error:" ascii wide nocase
    condition:
        all of ($path*) and $error
}

Sigma Rule

title: CVE-2025-20002 GMOD Apollo Path Disclosure
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP responses containing local file paths from GMOD Apollo upload errors
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains: "upload"
        sc-status: 200
        sc-bytes|gte: 100
        cs-uri-stem|endswith: ".php"
    condition: selection
falsepositives:
    - Legitimate error messages from other applications
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-20002 GMOD Apollo Path Disclosure"; flow:to_server,established; content:"POST"; http_method; content:"upload"; http_uri; content:"Error:"; http_server_body; pcre:"/\/var\/www\/html\/|\/tmp\/|\/home\//"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable file upload functionality in GMOD Apollo until a patch is available.
2. Short-term: Modify the application code to use generic error messages that do not include file paths. For example, replace die("Error: $filePath is not allowed.") with die("Error: File upload failed.").
3. Long-term: Apply the official patch from the vendor when released. Monitor the GMOD Apollo repository for updates.
4. Compensating Controls: Implement a Web Application Firewall (WAF) rule to block responses containing common path patterns (e.g., /var/www/, /tmp/). Restrict web server error reporting to generic messages.

Valters IT
DevSecOps & Cyber Threat Intelligence