CVE-2025-27413

Executive Summary

CVE-2025-27413 is a critical vulnerability in PwnDoc, a penetration test reporting application. The flaw resides in the backup restore functionality, which allows an administrator to import raw data containing path traversal sequences (../). This data is then used by the template update functionality to write arbitrary content to any location on the filesystem. An attacker with the backups:create, backups:update, and templates:update permissions (default administrators) can overwrite source code files, leading to Remote Code Execution (RCE). The vulnerability is unpatched in versions prior to 1.2.0, and a fix is available in version 1.2.0.

Supply Chain & Package Security

PwnDoc is a Node.js application. The vulnerability does not directly affect the supply chain of packages (e.g., NPM), but the exploitation could lead to the compromise of the application's source code and configuration files. Organizations using PwnDoc should treat this as a high-priority security issue and upgrade immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: High. While the CVSS score is 6.5, the potential for RCE and the ability to overwrite arbitrary files makes this a critical threat in practice. The requirement for admin privileges reduces the attack surface, but once an admin account is compromised, full system compromise is possible.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) combined with arbitrary file write. The backup restore functionality in PwnDoc accepts a JSON payload containing file paths and content. The application fails to sanitize the path field, allowing an attacker to include ../ sequences to escape the intended backup directory.

The template update functionality then reads these paths from the database and writes the associated content to the filesystem. By crafting a backup with a path like ../../app.js or ../../config.js, an attacker can overwrite critical application files. For example, overwriting a JavaScript file that is executed by the Node.js server can lead to immediate RCE.

The attack flow:

1. Attacker gains admin privileges (e.g., through credential theft or social engineering).
2. Attacker creates a malicious backup with a path traversal payload.
3. Attacker restores the backup, which imports the malicious data into the database.
4. Attacker triggers a template update, which writes the malicious content to the target file.
5. The next request to the application executes the overwritten file, achieving RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.2.0): The backup restore function likely does not validate or sanitize the path field. Example pseudocode:

function restoreBackup(data) {
    data.forEach(item => {
        // No path validation
        fs.writeFileSync(item.path, item.content);
    });
}

Patched Code (1.2.0): The fix adds path validation to prevent traversal. Example pseudocode:

function restoreBackup(data) {
    const allowedBase = path.resolve('/var/pwndoc/backups');
    data.forEach(item => {
        const resolvedPath = path.resolve(allowedBase, item.path);
        // Ensure the resolved path is within the allowed base
        if (!resolvedPath.startsWith(allowedBase)) {
            throw new Error('Invalid path');
        }
        fs.writeFileSync(resolvedPath, item.content);
    });
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for PwnDoc.
• Network access to the PwnDoc instance.

Exploitation Steps:

1. Craft Malicious Backup: Create a JSON payload that includes a path traversal to overwrite a critical file. For example, to overwrite the main application file:

   {
     "backup": [
       {
         "path": "../../app.js",
         "content": "require('child_process').exec('id > /tmp/pwned');"
       }
     ]
   }
   

2. Restore Backup: Use the admin API or UI to restore the crafted backup.
3. Trigger Template Update: Navigate to the template update functionality to write the malicious content.
4. Execute Payload: Access the application's main page to trigger the overwritten app.js, executing the command.

Alternative Payload: Overwrite a configuration file to add a new admin user or disable authentication.

Blue Team

Detection:

• Monitor for unusual backup restore operations, especially those with large or unexpected file paths.
• Alert on file writes outside of the expected backup directory.
• Use file integrity monitoring (FIM) to detect changes to critical application files.

Hunting:

• Search logs for path traversal patterns (../) in backup restore requests.
• Look for sudden changes to application source files (e.g., app.js, server.js).

Mitigation:

• Immediately upgrade to PwnDoc 1.2.0.
• Restrict admin privileges to only trusted users.
• Implement network segmentation to limit access to the PwnDoc instance.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected modifications to files in the PwnDoc installation directory (e.g., app.js, config.js).
  • Presence of files in /tmp/ or other unusual locations created by the application.
• Network:
  • HTTP requests to the backup restore endpoint with suspicious path values containing ../.
• Logs:
  • Application logs showing file write errors or path traversal attempts.
  • System logs showing execution of unexpected commands (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2025_27413_PwnDoc_PathTraversal {
    meta:
        description = "Detects path traversal patterns in PwnDoc backup restore data"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-27413"
    strings:
        $path_traversal = /\.\.\/[^"]*/
    condition:
        $path_traversal
}

Sigma Rule

title: PwnDoc Backup Restore Path Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in PwnDoc backup restore requests
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27413
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate backup files with similar patterns (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-27413 PwnDoc Backup Restore Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/api/backup/restore"; http_uri; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update PwnDoc to version 1.2.0 or later.
2. Restrict Access: Limit admin privileges to essential personnel only.
3. Monitor: Enable logging and monitoring for backup restore operations.

Long-Term Measures:

• Implement input validation and sanitization for all file paths.
• Use a whitelist of allowed directories for file writes.
• Conduct regular security audits and penetration testing.

Valters IT Signature: This report was generated by Valters IT, your trusted partner in DevSecOps and Cyber Threat Intelligence. Stay secure, stay vigilant.