CVE-2025-24350

Executive Summary

CVE-2025-24350 is a high-severity vulnerability (CVSS 7.1) in the ctrlX OS web application, specifically within the “Certificates and Keys” functionality. A remote authenticated attacker with low privileges can exploit a path traversal flaw to write arbitrary certificates to arbitrary file system paths via a crafted HTTP request. This can lead to unauthorized certificate injection, potentially enabling man-in-the-middle attacks, service impersonation, or privilege escalation. No public exploit code or patch details are currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs valid low-privilege credentials.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): High (H) – Arbitrary certificate injection compromises trust.
• Availability (A): High (H) – Could disrupt certificate-based services.

Threat Level: High – Integrity and availability impacts are severe, though authentication is required.

Deep Dive & Mechanics

The vulnerability resides in the “Certificates and Keys” module of ctrlX OS, which handles certificate management for secure communications. The web application fails to properly sanitize user-supplied file paths when processing certificate uploads or writes. A low-privileged attacker can craft an HTTP request containing path traversal sequences (e.g., ../) to write a malicious certificate to an arbitrary location, such as system trust stores, application directories, or configuration files.

Attack Flow:

1. Authenticate as a low-privileged user to the ctrlX OS web interface.
2. Intercept the certificate upload request (e.g., POST to /api/certificates/upload).
3. Modify the filepath parameter to include traversal sequences (e.g., ../../etc/ssl/certs/malicious.crt).
4. Submit the request with a crafted certificate payload.
5. The server writes the certificate to the specified path, potentially overwriting trusted certificates.

Impact: An attacker could inject a self-signed or attacker-controlled CA certificate, enabling TLS interception, service impersonation, or bypassing certificate validation for other components.

Vulnerable vs. Patched Code

No patch details are available. The following is a hypothetical vulnerable code pattern based on the CVE description.

Vulnerable Code (Python Flask example):

@app.route('/api/certificates/upload', methods=['POST'])
def upload_certificate():
    cert_data = request.files['certificate']
    filepath = request.form['filepath']  # No sanitization
    with open(filepath, 'wb') as f:
        f.write(cert_data.read())
    return "Certificate uploaded", 200

Patched Code (Hypothetical):

import os
from werkzeug.utils import secure_filename

@app.route('/api/certificates/upload', methods=['POST'])
def upload_certificate():
    cert_data = request.files['certificate']
    filepath = request.form['filepath']
    # Sanitize path to prevent traversal
    safe_path = os.path.normpath('/var/ctrlx/certs/' + filepath)
    if not safe_path.startswith('/var/ctrlx/certs/'):
        return "Invalid path", 400
    filename = secure_filename(os.path.basename(safe_path))
    full_path = os.path.join('/var/ctrlx/certs/', filename)
    with open(full_path, 'wb') as f:
        f.write(cert_data.read())
    return "Certificate uploaded", 200

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Low-privilege credentials for ctrlX OS web interface.
• Network access to the ctrlX web application (e.g., port 443).

Exploitation Steps:

1. Log in to the ctrlX web interface.
2. Use a tool like Burp Suite or curl to craft a malicious request:

   curl -k -X POST https://target-ip/api/certificates/upload \
     -H "Cookie: session=valid_session_cookie" \
     -F "certificate=@malicious.crt" \
     -F "filepath=../../etc/ssl/certs/malicious.crt"
   

3. Verify the certificate was written by attempting to access a service that uses the trust store.

Expected Outcome: The malicious certificate is placed in the system trust store, allowing the attacker to intercept TLS traffic.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual file writes to certificate directories (e.g., /etc/ssl/certs/, /var/ctrlx/certs/).
• Alert on HTTP requests containing path traversal patterns in the filepath parameter.
• Use file integrity monitoring (FIM) to detect unauthorized changes to certificate stores.

Response:

1. Isolate the affected system from the network.
2. Review logs for the attacker’s session and IP address.
3. Restore legitimate certificates from backup.
4. Apply vendor patch when available.
5. Rotate all credentials and certificates.

Indicators of Compromise (IOCs)

• File Paths: /etc/ssl/certs/malicious.crt, /var/ctrlx/certs/ (unexpected files)
• Network: HTTP POST requests to /api/certificates/upload with filepath containing ../
• Logs: Entries showing certificate uploads from low-privilege users to system paths
• Certificate: Self-signed or untrusted CA certificates in system trust stores

Detection Engineering

YARA Rule

rule CVE_2025_24350_Certificate_Traversal {
    meta:
        description = "Detects path traversal attempts in certificate upload requests to ctrlX OS"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-24350"
    strings:
        $traversal = /\.\.\// nocase
        $cert_ext = ".crt" nocase
        $upload_path = "/api/certificates/upload" nocase
    condition:
        $upload_path and $traversal and $cert_ext
}

Sigma Rule

title: CVE-2025-24350 - Path Traversal in ctrlX OS Certificate Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal in certificate uploads to ctrlX OS
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/certificates/upload'
        cs-uri-query|contains: 'filepath='
    filter:
        cs-uri-query|contains: 'filepath=../../'
    condition: selection and filter
falsepositives:
    - Legitimate certificate management by administrators
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24350 - ctrlX OS Certificate Path Traversal"; flow:to_server; http.method; content:"POST"; http.uri; content:"/api/certificates/upload"; http.client_body; content:"filepath"; content:"../"; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict access to the ctrlX web interface to trusted networks only.
2. Implement strict input validation for the filepath parameter (e.g., whitelist allowed directories).
3. Use a web application firewall (WAF) to block path traversal patterns.
4. Monitor certificate stores for unauthorized changes.

Long-Term Fix:

• Apply vendor patch when released (currently UNKNOWN).
• Upgrade to a patched version of ctrlX OS.
• Conduct a security audit of the certificate management module.

Workaround:

• Disable the “Certificates and Keys” functionality if not required.
• Use network segmentation to limit exposure.

Valters IT