CVE-2025-34076

Executive Summary

CVE-2025-34076 is a critical authenticated Local File Inclusion (LFI) vulnerability in Microweber CMS versions 1.2.11 and earlier. The flaw resides in the backup management API, specifically the /api/BackupV2/upload and /api/BackupV2/download endpoints. An authenticated attacker can abuse insufficient path validation to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, credentials, or application source code. The vulnerability stems from the application's failure to sanitize user-supplied file paths, allowing absolute path traversal. While the CVSS score is listed as 0.0 in the NVD, this is likely a placeholder; the actual severity is high due to the potential for complete information disclosure. No official patch has been released as of this analysis.

Supply Chain & Package Security

Microweber is a PHP-based CMS distributed via Composer and GitHub. The vulnerability exists in the core application code, not in a third-party package. However, organizations using Microweber should audit their Composer dependencies for any outdated or vulnerable packages that may be leveraged in conjunction with this LFI to escalate an attack.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required; the attacker only needs to be authenticated.
• Privileges Required (PR): Low (L) - A standard authenticated user account is sufficient.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Arbitrary file read can expose sensitive data.
• Integrity (I): Low (L) - The upload endpoint can potentially delete or relocate files, affecting integrity.
• Availability (A): None (N) - No direct impact on availability.

CVSS Score: 7.1 (High) - This reflects the high confidentiality impact and low attack complexity.

Deep Dive & Mechanics

The vulnerability is rooted in the backup management API's handling of file paths. The /api/BackupV2/upload endpoint accepts a src parameter that specifies the source file path. The application fails to validate whether this path is within the allowed backup directory. An attacker can supply an absolute path, such as /etc/passwd or ../../../etc/passwd, and the server will attempt to process that file as a backup source.

The /api/BackupV2/download endpoint then allows the attacker to retrieve the processed file. The combination of these two endpoints enables a complete LFI attack chain:

1. Upload Phase: The attacker sends a POST request to /api/BackupV2/upload with the src parameter set to the target file (e.g., /etc/passwd). The server may copy, move, or symlink the file into the backup storage directory.
2. Download Phase: The attacker sends a GET request to /api/BackupV2/download with the filename (or a predictable identifier) to retrieve the file contents.

The root cause is insufficient input validation and a lack of path canonicalization checks. The application does not verify that the resolved path is within the intended backup directory, nor does it restrict access to sensitive system files.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a conceptual comparison of the vulnerable code and a potential fix.

Vulnerable Code (PHP):

// Vulnerable: No path validation
public function upload($src) {
    $backupDir = storage_path('backups');
    $dest = $backupDir . '/' . basename($src);
    copy($src, $dest); // Direct copy without checking path
}

Patched Code (Conceptual):

// Patched: Validate and restrict path
public function upload($src) {
    $backupDir = storage_path('backups');
    $realSrc = realpath($src);
    $realBackupDir = realpath($backupDir);
    
    // Ensure the source is within the backup directory
    if (strpos($realSrc, $realBackupDir) !== 0) {
        throw new Exception('Invalid source path');
    }
    
    $dest = $backupDir . '/' . basename($src);
    copy($src, $dest);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid authenticated session cookie for a Microweber CMS instance (version <= 1.2.11).
• Network access to the target server.

Exploitation Steps:

1. Authenticate: Obtain a valid session cookie by logging in as a standard user.
2. Upload Phase: Send a POST request to /api/BackupV2/upload with the target file path.

   curl -X POST 'http://target.com/api/BackupV2/upload' \
     -H 'Cookie: microweber_session=YOUR_SESSION' \
     -d 'src=/etc/passwd'
   

3. Download Phase: Retrieve the file using the download endpoint. The filename may be predictable (e.g., passwd) or returned in the upload response.

   curl -X GET 'http://target.com/api/BackupV2/download?file=passwd' \
     -H 'Cookie: microweber_session=YOUR_SESSION'
   

Expected Output: The contents of /etc/passwd will be returned in the response body.

Blue Team

Detection Steps:

1. Monitor API Endpoints: Look for unusual requests to /api/BackupV2/upload and /api/BackupV2/download from authenticated users.
2. Analyze src Parameter: Check for absolute paths (e.g., /etc/, /var/, /proc/) or path traversal sequences (../) in the src parameter.
3. Correlate Events: If a user uploads a file and immediately downloads it, investigate the file path used.
4. Check Backup Directory: Inspect the backup storage directory for unexpected files (e.g., system files like passwd, shadow, or configuration files).

Indicators of Compromise (IOCs)

• File Paths: Unusual files in the backup directory (e.g., /path/to/backups/passwd, /path/to/backups/shadow).
• Network Requests: POST requests to /api/BackupV2/upload with src containing absolute paths or ../ sequences.
• Log Entries: Web server logs showing requests to /api/BackupV2/download with filenames matching system files.
• File Hashes: Hashes of known system files (e.g., /etc/passwd) appearing in unexpected locations.

Detection Engineering

YARA Rule

rule CVE_2025_34076_Microweber_LFI {
    meta:
        description = "Detects exploitation attempts of CVE-2025-34076 in Microweber CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34076"
    strings:
        $api_upload = "/api/BackupV2/upload"
        $api_download = "/api/BackupV2/download"
        $path_traversal = /src=[\"']?(\/|\.\.\/)/
        $abs_path = /src=[\"']?\/(etc|var|proc|sys|boot|dev)/
    condition:
        ($api_upload or $api_download) and ($path_traversal or $abs_path)
}

Sigma Rule

title: CVE-2025-34076 Microweber LFI Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit LFI in Microweber backup API
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/api/BackupV2/upload'
    filter:
        cs-uri-query|contains: 'src='
    condition: selection and filter
falsepositives:
    - Legitimate backup operations using valid paths
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-34076 Microweber LFI Exploitation Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/BackupV2/upload"; http_uri;
    content:"src="; http_client_body;
    pcre:"/src=[\"']?(\/|\.\.\/)/Ri";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Backup API: If not required, disable the /api/BackupV2/upload and /api/BackupV2/download endpoints via web server configuration (e.g., .htaccess or Nginx location block).
2. Restrict Access: Limit access to the backup API to trusted IP addresses or admin users only.
3. Apply Input Validation: Implement strict path validation and canonicalization on the src parameter. Ensure that only files within the designated backup directory can be processed.

Long-Term Fix:

• Upgrade to a patched version of Microweber once available.
• Implement a Web Application Firewall (WAF) rule to block requests containing absolute paths or path traversal sequences in the src parameter.

Workaround:

• Modify the application code to use realpath() and verify that the resolved path starts with the backup directory path.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert