CVE-2025-32950

Executive Summary

CVE-2025-32950 is a path traversal vulnerability in Jmix, a set of libraries and tools for Spring Boot data-centric application development. The flaw allows an unauthenticated attacker to manipulate the FileRef parameter to read arbitrary files from the server filesystem, provided the application server has the necessary permissions. The attack can be executed by modifying the FileRef directly in the database or by supplying a malicious value in the fileRef parameter of the /files endpoint of the generic REST API. The vulnerability affects versions 1.0.0 to 1.6.1 and 2.0.0 to 2.3.4. Patches are available in versions 1.6.2 and 2.4.0, and a workaround is provided on the Jmix documentation website. The CVSS score is 6.5 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity or availability impact.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit the vulnerability.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – An attacker can read sensitive files, including configuration files, credentials, and application data.
• Integrity Impact: None (I:N) – The attacker cannot modify files.
• Availability Impact: None (A:N) – The attacker cannot cause a denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the ease of exploitation (no authentication, low complexity) and the potential for high confidentiality impact elevate the risk. The EPSS score of 0.0% suggests low exploitation activity in the wild, but this may change as the vulnerability becomes more widely known.

Deep Dive & Mechanics

The vulnerability resides in the file handling mechanism of Jmix. The FileRef parameter is used to reference files stored by the application. The flaw is a classic path traversal (CWE-22) where the application fails to properly sanitize user-supplied input in the FileRef parameter.

Attack Vectors:

1. Direct Database Manipulation: An attacker with access to the database (e.g., through SQL injection or compromised credentials) can modify the FileRef value in the database to point to an arbitrary file path (e.g., /etc/passwd). When the application retrieves and serves this file, the attacker gains access to its contents.

2. REST API Exploitation: The generic REST API endpoint /files accepts a fileRef parameter. By sending a crafted request with a path traversal sequence (e.g., ../../etc/passwd), an attacker can bypass the intended file access restrictions and read arbitrary files from the server's filesystem.

Root Cause: The application does not validate or sanitize the FileRef parameter to ensure it points to a file within the intended storage directory. It also fails to resolve path traversal sequences (e.g., ../) before accessing the file.

Impact: An attacker can read sensitive files such as:

• Application configuration files (e.g., application.properties, application.yml)
• Database credentials and connection strings
• SSH keys and other secrets
• Source code and business logic
• System files (e.g., /etc/passwd, /etc/shadow)

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Directly uses the fileRef parameter without validation
public ResponseEntity<Resource> getFile(@RequestParam("fileRef") String fileRef) {
    Path filePath = Paths.get(fileRef);
    Resource resource = new FileSystemResource(filePath);
    if (resource.exists()) {
        return ResponseEntity.ok(resource);
    }
    return ResponseEntity.notFound().build();
}

Patched Code (Conceptual):

// Patched: Validates that the fileRef is within the allowed storage directory
public ResponseEntity<Resource> getFile(@RequestParam("fileRef") String fileRef) {
    // Normalize the path to resolve any traversal sequences
    Path normalizedPath = Paths.get(fileRef).normalize();
    // Ensure the resolved path is within the allowed base directory
    Path basePath = Paths.get("/var/jmix/files/").normalize();
    if (!normalizedPath.startsWith(basePath)) {
        return ResponseEntity.badRequest().build();
    }
    Resource resource = new FileSystemResource(normalizedPath);
    if (resource.exists()) {
        return ResponseEntity.ok(resource);
    }
    return ResponseEntity.notFound().build();
}

The patched code normalizes the path to resolve ../ sequences and then checks that the resulting path starts with the allowed base directory. This prevents path traversal attacks.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Jmix application running a vulnerable version (1.0.0 to 1.6.1 or 2.0.0 to 2.3.4).
• Network access to the /files REST API endpoint.

Exploitation Steps:

1. Identify the Endpoint: Use a tool like curl or Burp Suite to discover the /files endpoint. This is typically part of the Jmix generic REST API.

2. Craft the Payload: Construct a request with a path traversal payload in the fileRef parameter.

   curl -X GET "http://target.com/files?fileRef=../../etc/passwd"
   

3. Retrieve Sensitive Files: If successful, the server will return the contents of /etc/passwd. Try other files like application.properties:

   curl -X GET "http://target.com/files?fileRef=../../WEB-INF/classes/application.properties"
   

4. Database Manipulation (Alternative): If you have database access, modify the FileRef column in the relevant table to point to a target file. The next time the application serves that file, it will return the target file's contents.

Expected Output: The server returns the contents of the requested file in the HTTP response body.

Blue Team (Defensive)

Detection and Response:

1. Monitor Logs: Look for unusual patterns in web server logs, such as:

   • Requests to /files with fileRef parameters containing ../ or other path traversal sequences.
   • Repeated attempts to access files outside the expected storage directory.
   • Unusual file access patterns in application logs.

2. Network Monitoring: Use network monitoring tools to detect anomalous outbound traffic from the application server, which may indicate data exfiltration.

3. File Integrity Monitoring: Implement file integrity monitoring (FIM) on critical system files and application configuration files to detect unauthorized access.

4. Honeypots: Deploy decoy files (e.g., fake_credentials.txt) in the application's file storage area. Any access to these files is a strong indicator of an attack.

5. Immediate Actions:

   • Block the attacker's IP address at the firewall or WAF.
   • Revoke any exposed credentials.
   • Apply the patch or workaround immediately.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /files with fileRef parameter containing ../ or %2e%2e%2f (URL-encoded path traversal).
  • Unusual outbound data transfers from the application server.
• File System IOCs:
  • Unexpected access to files outside the application's designated storage directory.
  • Modification of FileRef values in the database to point to system files.
• Log IOCs:
  • Application logs showing errors related to file access outside the expected directory.
  • Web server logs showing requests with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_32950_Jmix_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Jmix /files endpoint"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-32950"
        severity = "high"
    strings:
        $path_traversal1 = "../" ascii wide nocase
        $path_traversal2 = "..\\" ascii wide nocase
        $path_traversal3 = "%2e%2e%2f" ascii wide nocase
        $path_traversal4 = "%2e%2e%5c" ascii wide nocase
        $endpoint = "/files" ascii wide nocase
        $param = "fileRef" ascii wide nocase
    condition:
        all of ($endpoint, $param) and any of ($path_traversal*)
}

Sigma Rule

title: Jmix FileRef Path Traversal Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-7e0f1a2b3c4d
status: experimental
description: Detects HTTP requests to Jmix /files endpoint with path traversal sequences in the fileRef parameter.
author: Valters IT
date: 2025-04-17
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-32950
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/files'
            - 'fileRef='
        cs-uri-query|contains|all:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of file references with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32950 Jmix FileRef Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/files"; http_uri; content:"fileRef="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the Patch: Upgrade to Jmix version 1.6.2 or 2.4.0 (or later) as soon as possible.
2. Implement Workaround: If immediate patching is not possible, follow the workaround provided on the Jmix documentation website. This typically involves adding input validation and sanitization for the fileRef parameter.
3. Restrict Network Access: Limit access to the /files endpoint to trusted IP addresses or networks using a firewall or WAF.
4. Review Database Permissions: Ensure that only authorized users and applications have write access to the database tables that store FileRef values.

Long-Term Measures:

1. Input Validation: Implement strict input validation for all user-supplied parameters, especially those used in file operations. Use a whitelist of allowed characters and patterns.
2. Path Normalization: Always normalize file paths before use and verify that the resulting path is within the intended directory.
3. Principle of Least Privilege: Run the application server with the minimum necessary filesystem permissions. Do not run as root.
4. Regular Security Audits: Conduct regular code reviews and penetration testing to identify and fix similar vulnerabilities.
5. Web Application Firewall (WAF): Deploy a WAF with rules to detect and block path traversal attempts.

Valters IT