CVE-2025-27101

Executive Summary

CVE-2025-27101 is a path traversal vulnerability in Opal, OBiBa’s core database application for biobanks and epidemiological studies. The flaw allows any authenticated user to copy a parent directory to the /temp/ folder, which results in all files within that parent directory being copied, including files the user should not have access to. This enables low-privilege users, such as DataShield users, to retrieve files belonging to other users, effectively exposing the entire Opal filesystem. The vulnerability is patched in version 5.1.1.

Supply Chain & Package Security

This vulnerability affects the Opal application, which is a Java-based web application. There are no direct NPM, PyPI, Go, or Ruby package dependencies involved. The risk is primarily to the confidentiality of data stored within the Opal filesystem.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – Any authenticated user can exploit it.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – All files in the Opal filesystem can be read.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires authentication. The impact is limited to data confidentiality.

Deep Dive & Mechanics

The vulnerability resides in the file copy functionality of Opal. When a user initiates a copy operation of a parent directory to the /temp/ folder, the application fails to properly validate the user's permissions for all files within that directory. Instead of checking access rights for each file, it blindly copies the entire directory tree, including files that the user should not have access to.

Root Cause: The application does not enforce access control checks during the recursive copy operation. The copy function likely iterates through the source directory and copies all files without verifying the user's permissions for each file.

Attack Vector: An authenticated user (including low-privilege DataShield users) can craft a request to copy a parent directory (e.g., /home/, /etc/, or any directory containing sensitive files) to the /temp/ directory. After the copy, the user can access the copied files in /temp/ to read sensitive data.

Impact: Full disclosure of all files in the Opal filesystem, including configuration files, other users' data, and potentially system files.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

public void copyDirectory(File sourceDir, File destDir, User user) {
    // No permission check for each file
    for (File file : sourceDir.listFiles()) {
        if (file.isDirectory()) {
            copyDirectory(file, new File(destDir, file.getName()), user);
        } else {
            // Direct copy without checking user's access to 'file'
            copyFile(file, new File(destDir, file.getName()));
        }
    }
}

Patched Code (Conceptual):

public void copyDirectory(File sourceDir, File destDir, User user) {
    for (File file : sourceDir.listFiles()) {
        // Check if the user has permission to read the file
        if (!permissionService.canRead(user, file)) {
            throw new AccessDeniedException("User does not have permission to read: " + file.getPath());
        }
        if (file.isDirectory()) {
            copyDirectory(file, new File(destDir, file.getName()), user);
        } else {
            copyFile(file, new File(destDir, file.getName()));
        }
    }
}

The patched version adds a permission check (permissionService.canRead(user, file)) before copying each file, ensuring that users can only copy files they have explicit access to.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to an Opal instance (version < 5.1.1).
• Valid user credentials (any level, including DataShield).

Exploitation Steps:

1. Authenticate: Log in to the Opal web interface or use the REST API with valid credentials.
2. Identify Target Directory: Determine a parent directory containing sensitive files (e.g., /home/admin/, /etc/opal/, or /var/lib/opal/).
3. Craft Copy Request: Use the file copy functionality to copy the target parent directory to /temp/. This can be done via the web UI or by sending a direct API request.

   POST /ws/files/copy HTTP/1.1
   Host: opal.example.com
   Authorization: Basic <base64-encoded-credentials>
   Content-Type: application/json
   
   {
     "source": "/home/admin/",
     "destination": "/temp/",
     "recursive": true
   }
   

4. Access Copied Files: Navigate to /temp/ in the file browser or use the API to list and download the copied files.

   GET /ws/files/temp/ HTTP/1.1
   Host: opal.example.com
   Authorization: Basic <base64-encoded-credentials>
   

Blue Team

Detection:

• Monitor for unusual file copy operations, especially from high-value directories (e.g., /home/, /etc/, /var/lib/opal/) to /temp/.
• Alert on any access to /temp/ by low-privilege users (e.g., DataShield users).
• Look for patterns of bulk file downloads from the /temp/ directory.

Hunting:

• Search logs for copy operations where the source is a parent directory and the destination is /temp/.
• Review access logs for users accessing files in /temp/ that they should not normally access.

Indicators of Compromise (IOCs)

• File System: Unexpected files or directories in /temp/ that mirror parent directories (e.g., /temp/admin/, /temp/etc/).
• Logs: Log entries showing copy operations from sensitive directories to /temp/ by low-privilege users.
• Network: Unusual outbound data transfers from the Opal server, potentially indicating exfiltration of copied files.

Detection Engineering

YARA Rule

rule CVE_2025_27101_Opal_Path_Traversal {
    meta:
        description = "Detects attempts to copy parent directories to /temp/ in Opal logs"
        author = "Valters IT"
        date = "2025-03-20"
        cve = "CVE-2025-27101"
    strings:
        $copy_op = /copy.*\/temp\// nocase
        $parent_dir = /\/home\/|\/etc\/|\/var\/lib\/opal\// nocase
    condition:
        $copy_op and $parent_dir
}

Sigma Rule

title: Opal Path Traversal via Directory Copy to /temp/
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects file copy operations from parent directories to /temp/ in Opal logs
author: Valters IT
date: 2025-03-20
logsource:
    category: application
    product: opal
detection:
    selection:
        EventID: 1001  # Example event ID for file copy
        SourcePath|contains:
            - '/home/'
            - '/etc/'
            - '/var/lib/opal/'
        DestinationPath|contains: '/temp/'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-27101 - Opal Path Traversal via Directory Copy to /temp/";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/ws/files/copy"; http_uri;
    content:"\"source\""; nocase;
    content:"\"destination\""; nocase;
    content:"/temp/"; nocase;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

1. Upgrade: Upgrade Opal to version 5.1.1 or later immediately.
2. Restrict Access: If immediate upgrade is not possible, restrict access to the file copy functionality to only highly trusted users.
3. Monitor: Enable detailed logging of all file operations and monitor for suspicious copy activities.

Long-term:

1. Access Control Review: Conduct a thorough review of all file access controls within the application.
2. Penetration Testing: Perform regular penetration testing to identify similar vulnerabilities.
3. Input Validation: Implement strict input validation and permission checks for all file operations.

Workaround:

• If upgrading is not possible, consider disabling the file copy functionality entirely or removing the ability to copy directories to /temp/ via configuration changes.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert