CVE-2025-30005

Executive Summary

CVE-2025-30005 is a critical path traversal vulnerability in Xorcom CompletePBX, affecting all versions up to and including 5.2.35. The flaw resides in the Diagnostics reporting module, allowing an unauthenticated attacker to read arbitrary files from the server and delete any retrieved file in place of the expected report. This can lead to full system compromise, data exfiltration, and denial of service. The CVSS score is 8.3 (High), and no public exploit or patch is currently available. The vulnerability is classified under CWE-22 (Path Traversal) and aligns with MITRE ATT&CK technique T1190 (Exploit Public-Facing Application).

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Arbitrary file read exposes sensitive data.
• Integrity (I): High (H) – File deletion can corrupt system state.
• Availability (A): High (H) – Deleting critical files can cause denial of service.

Threat Level: High. The combination of remote, unauthenticated access with both read and delete capabilities makes this a severe risk for any organization using Xorcom CompletePBX.

Deep Dive & Mechanics

The vulnerability exists in the Diagnostics reporting module of Xorcom CompletePBX. This module is designed to generate diagnostic reports for troubleshooting. However, it fails to properly sanitize user-supplied input used to specify file paths. An attacker can craft a request with path traversal sequences (e.g., ../../../etc/passwd) to read arbitrary files from the server. Additionally, the module deletes the retrieved file after reading it, meaning the attacker can also delete any file they can read, including system configuration files, logs, or application binaries.

The attack flow:

1. The attacker sends a specially crafted HTTP request to the Diagnostics reporting endpoint.
2. The request includes a file parameter with path traversal sequences.
3. The server reads the specified file and returns its contents in the response.
4. The server then deletes the file, causing a denial of service or system instability.

This is a classic path traversal vulnerability (CWE-22) with an added destructive element.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable endpoint in Diagnostics module
@app.route('/diagnostics/report')
def generate_report():
    file_path = request.args.get('file')
    # No input validation or sanitization
    with open(file_path, 'r') as f:
        content = f.read()
    # Delete the file after reading
    os.remove(file_path)
    return content

Patched Code (Conceptual):

# Patched endpoint in Diagnostics module
import os
from pathlib import Path

ALLOWED_DIR = Path('/var/log/completepbx/diagnostics')

@app.route('/diagnostics/report')
def generate_report():
    file_param = request.args.get('file')
    # Resolve the path and ensure it is within the allowed directory
    requested_path = (ALLOWED_DIR / file_param).resolve()
    if not str(requested_path).startswith(str(ALLOWED_DIR)):
        return "Access denied", 403
    if not requested_path.exists():
        return "File not found", 404
    with open(requested_path, 'r') as f:
        content = f.read()
    # Do not delete the file; only copy or generate report
    return content

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Xorcom CompletePBX instance (version 5.2.35 or earlier) in an isolated environment.
2. Ensure the Diagnostics module is accessible via HTTP.

Exploitation Steps:

1. Identify the Diagnostics reporting endpoint (e.g., /diagnostics/report).
2. Craft a request to read a sensitive file:

   GET /diagnostics/report?file=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. The server will return the contents of /etc/passwd and then delete it.
4. To delete a critical file (e.g., /etc/shadow):

   GET /diagnostics/report?file=../../../etc/shadow HTTP/1.1
   Host: target.com
   

5. The file is deleted after being read, causing potential system instability.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team

Detection:

• Monitor for HTTP requests containing path traversal sequences (e.g., ../, ..\\, %2e%2e%2f) in the Diagnostics module.
• Alert on unusual file read operations from the Diagnostics module, especially for files outside the expected report directory.
• Use file integrity monitoring (FIM) to detect unexpected deletions of system files.

Hunting:

• Search web server logs for requests to /diagnostics/report with suspicious file parameters.
• Look for patterns like file=../../../ or file=..%2f..%2f..%2f.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /diagnostics/report with file parameter containing path traversal sequences.
  • Outbound data transfers containing contents of sensitive files (e.g., /etc/passwd, /etc/shadow).
• File System IOCs:
  • Unexpected deletion of files in /etc/, /var/log/, or other system directories.
  • Presence of diagnostic report files in unusual locations.
• System IOCs:
  • Unexplained service crashes or system instability after file deletions.
  • Missing critical system files (e.g., /etc/passwd, /etc/shadow).

Detection Engineering

YARA Rule

rule CVE_2025_30005_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Xorcom CompletePBX Diagnostics module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30005"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $endpoint = "/diagnostics/report"
    condition:
        any of ($traversal*) and $endpoint
}

Sigma Rule

title: CVE-2025-30005 Path Traversal in Xorcom CompletePBX
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in HTTP requests to the Diagnostics module
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30005
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem: "/diagnostics/report"
        cs-uri-query|contains:
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e%5c"
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30005 Path Traversal in Xorcom CompletePBX"; flow:to_server; content:"/diagnostics/report"; http_uri; content:"../"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: Disconnect Xorcom CompletePBX from the network if possible, or restrict access to the Diagnostics module via firewall rules.
2. Apply input validation: If source code access is available, implement strict input validation and sanitization for the file parameter in the Diagnostics module. Use a whitelist of allowed files or directories.
3. Disable the Diagnostics module: If not required, disable the Diagnostics reporting endpoint entirely.

Long-term Actions:

1. Monitor for patches: Continuously check for official patches from Xorcom. Apply immediately when available.
2. Upgrade: Upgrade to a patched version (5.2.36 or later) once released.
3. Implement WAF rules: Deploy Web Application Firewall (WAF) rules to block path traversal patterns.
4. Conduct security audits: Perform regular security assessments of all exposed services.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block requests containing path traversal sequences to the Diagnostics module:

  location /diagnostics/report {
      if ($args ~* "file=.*\.\.") {
          return 403;
      }
  }
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert