CVE-2025-24886

Executive Summary

CVE-2025-24886 is a high-severity vulnerability (CVSS 7.7) in the pwn.college education platform, specifically within its CTFd container integration. The flaw arises from incorrect symlink validation during repository cloning or updating operations. An authenticated attacker (no admin privileges required) can craft a malicious repository containing symlinks pointing to sensitive files on the CTFd container's filesystem. When the platform processes this repository, it fails to properly verify the symlink targets, allowing an attacker to perform Local File Inclusion (LFI) and retrieve arbitrary files from the container.

This vulnerability is particularly dangerous because it bypasses standard access controls and can lead to the exposure of configuration files, credentials, source code, or other sensitive data. The EPSS score of 0.0% suggests low exploitation activity currently, but the lack of a known patch makes this a critical concern for all pwn.college deployments.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the pwn.college platform, which is a custom application. The risk lies in the platform's handling of user-supplied repositories, which could be hosted on any Git provider (e.g., GitHub, GitLab). Attackers could inject malicious repositories into the supply chain of educational content, compromising the integrity of the learning environment.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – An attacker needs only a standard user account on the platform.
• User Interaction (UI): None – No victim interaction is required.
• Scope (S): Unchanged – The vulnerable component and the affected component are the same.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): High – An attacker can modify the repository content to include malicious symlinks.
• Availability (A): None – The vulnerability does not affect availability.

Threat Level: High. The combination of low privileges, network exploitability, and high impact on confidentiality and integrity makes this a serious threat. The lack of a patch amplifies the risk.

Deep Dive & Mechanics

The vulnerability resides in the repository cloning/update functionality of the pwn.college platform. When a user specifies a dojo (a repository containing challenges or materials), the platform performs a check to detect symlinks within the repository. However, this check is flawed:

1. Incorrect Symlink Validation: The platform likely uses a function like os.path.islink() or similar to detect symlinks, but it fails to resolve the symlink target or verify that the target is within an allowed directory. This allows an attacker to create a symlink pointing to an absolute path like /etc/passwd or a relative path like ../../../../etc/shadow.

2. Repository Processing: When the repository is cloned or updated, the platform extracts the files and processes them. If a symlink is present, the platform may follow it during file reading operations, exposing the target file's contents.

3. LFI via CTFd: The CTFd container serves the platform's web interface. By crafting a repository with symlinks to sensitive files (e.g., /proc/1/environ, /var/lib/ctfd/secret.key), an attacker can retrieve these files through the web interface, leading to information disclosure.

The attack flow:

• Attacker creates a Git repository with a symlink (e.g., malicious_link -> /etc/passwd).
• Attacker submits this repository as a dojo on the pwn.college platform.
• The platform clones the repository and fails to properly validate the symlink.
• When the platform reads the symlink (e.g., to display challenge content), it follows the link and exposes the target file.
• Attacker retrieves the file contents via the web interface.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern and a potential fix.

Vulnerable Code (Hypothetical):

import os
import shutil

def clone_repository(repo_url, dest_path):
    # Clone the repository
    os.system(f"git clone {repo_url} {dest_path}")
    
    # Check for symlinks (flawed)
    for root, dirs, files in os.walk(dest_path):
        for file in files:
            filepath = os.path.join(root, file)
            if os.path.islink(filepath):
                # Flawed: Only checks if it's a symlink, not the target
                print(f"Symlink found: {filepath}")
                # No further validation

Patched Code (Hypothetical):

import os
import shutil

def clone_repository(repo_url, dest_path):
    # Clone the repository
    os.system(f"git clone {repo_url} {dest_path}")
    
    # Check for symlinks with proper validation
    for root, dirs, files in os.walk(dest_path):
        for file in files:
            filepath = os.path.join(root, file)
            if os.path.islink(filepath):
                target = os.readlink(filepath)
                # Resolve the target path
                resolved_target = os.path.realpath(os.path.join(os.path.dirname(filepath), target))
                # Ensure the target is within the repository directory
                if not resolved_target.startswith(os.path.realpath(dest_path)):
                    raise Exception(f"Symlink target outside repository: {target}")
                print(f"Safe symlink: {filepath} -> {target}")

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Exploit the LFI to read sensitive files from the CTFd container.

Prerequisites:

• A user account on the pwn.college platform.
• Ability to create and host a Git repository (e.g., on GitHub).

Steps:

1. Create a Malicious Repository:

   • Create a new Git repository.
   • Add a symlink pointing to a sensitive file:

     mkdir exploit_repo
     cd exploit_repo
     ln -s /etc/passwd secret_file
     git add secret_file
     git commit -m "Add symlink"
     git remote add origin https://github.com/attacker/exploit_repo.git
     git push -u origin main
     

2. Submit the Repository as a Dojo:

   • Log in to pwn.college.
   • Navigate to the dojo creation/update page.
   • Provide the repository URL (https://github.com/attacker/exploit_repo.git).
   • Submit the form.

3. Retrieve the File:

   • The platform will clone the repository and process the symlink.
   • Access the dojo's content via the web interface (e.g., /dojos/exploit_repo/secret_file).
   • The file content will be displayed, revealing /etc/passwd.

Advanced Exploitation:

• Use symlinks to read configuration files like /var/lib/ctfd/secret.key or database credentials.
• Chain with other vulnerabilities for privilege escalation.

Blue Team (Defender)

Objective: Detect and prevent exploitation.

Detection:

• Monitor for unusual repository URLs containing symlinks.
• Log all file access attempts to sensitive paths (e.g., /etc/passwd, /proc/).
• Use file integrity monitoring (FIM) to detect unauthorized reads of sensitive files.

Prevention:

• Implement strict symlink validation as shown in the patched code.
• Use a whitelist of allowed symlink targets (e.g., only within the repository).
• Run the CTFd container with minimal privileges and read-only filesystems where possible.
• Apply the principle of least privilege to the container.

Hunting:

• Search for symlinks in user-submitted repositories that point outside the repository root.
• Analyze web server logs for requests to paths that resolve to sensitive files.

Indicators of Compromise (IOCs)

• File System:

  • Presence of symlinks in user repositories pointing to absolute paths (e.g., /etc/passwd, /proc/1/environ).
  • Unexpected file reads from /etc/, /proc/, /var/lib/ctfd/, etc.

• Network:

  • Outbound connections from the CTFd container to external Git repositories.
  • HTTP requests to the CTFd web interface with paths containing ../ or symlink-like patterns.

• Logs:

  • Web server logs showing requests to files outside the expected dojo directory.
  • Application logs indicating symlink detection failures or warnings.

• Process:

  • Unusual git clone or git pull commands executed by the web application user.
  • Processes reading sensitive files (e.g., cat /etc/passwd).

Detection Engineering

YARA Rule

rule CVE_2025_24886_Symlink_LFI {
    meta:
        description = "Detects symlinks pointing to sensitive files in pwn.college repositories"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-24886"
    strings:
        $symlink = /ln -s \/[a-zA-Z0-9_\/]+/ nocase
        $sensitive_path = /\/etc\/(passwd|shadow|hosts|hostname|resolv.conf)/ nocase
        $proc_path = /\/proc\/[0-9]+\/environ/ nocase
        $ctfd_path = /\/var\/lib\/ctfd\// nocase
    condition:
        any of ($symlink) and any of ($sensitive_path, $proc_path, $ctfd_path)
}

Sigma Rule

title: CVE-2025-24886 - Symlink LFI in pwn.college
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit symlink LFI in pwn.college by monitoring file access patterns.
author: Valters IT
date: 2025-04-10
logsource:
    category: file_access
    product: linux
detection:
    selection:
        TargetFilename|contains:
            - '/etc/passwd'
            - '/etc/shadow'
            - '/proc/'
            - '/var/lib/ctfd/'
        Image|endswith: '/python3'
    condition: selection
falsepositives:
    - Legitimate administrative access to these files
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24886 - Symlink LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/dojos/"; http_uri; content:"../"; distance:0; within:10; pcre:"/\/etc\/passwd|\/proc\/|\/var\/lib\/ctfd\//Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Repository Cloning: Temporarily disable the dojo cloning/update functionality until a patch is available.
2. Manual Symlink Audit: Review all existing dojos for malicious symlinks.
3. Restrict File Access: Use AppArmor or SELinux to restrict the CTFd container's access to sensitive files.

Long-Term Fix:

• Patch the Symlink Validation: Implement proper symlink target resolution and validation as shown in the patched code example.
• Input Sanitization: Validate repository URLs and reject those containing symlinks to sensitive paths.
• Container Hardening: Run the CTFd container with a read-only root filesystem and minimal capabilities.

Workarounds:

• Use a web application firewall (WAF) to block requests containing ../ or symlink patterns.
• Implement a proxy that inspects repository contents before allowing cloning.

Report generated by Valters IT DevSecOps & CTI Expert System
Signature: Valters IT