CVE-2025-45890

Executive Summary

CVE-2025-45890 is a critical Directory Traversal vulnerability in the Novel-plus application (versions before 5.1.0). The flaw resides in the handling of the filePath parameter, allowing a remote, unauthenticated attacker to traverse directories and read arbitrary files from the server filesystem. This can lead to the disclosure of sensitive configuration files, source code, or credentials, and in some scenarios, may be chained with other weaknesses to achieve remote code execution. No public proof-of-concept (PoC) or exploit code has been released at this time, and the vendor has not issued a formal patch beyond recommending an upgrade to version 5.1.0.

Supply Chain & Package Security

Novel-plus is a Java-based web application typically distributed as a WAR file or via Maven. Organizations using Novel-plus should verify the integrity of their deployment artifacts and ensure they are sourced from the official repository. The lack of a signed advisory or CVE from the vendor increases supply chain risk; users should monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is rated Critical due to the lack of authentication required, low complexity, and the potential for full system compromise. An attacker can read arbitrary files, and if combined with other vulnerabilities (e.g., file upload or deserialization), can achieve remote code execution.

Deep Dive & Mechanics

The vulnerability exists in the file retrieval functionality of Novel-plus. The application fails to properly sanitize user-supplied input to the filePath parameter, allowing path traversal sequences such as ../ to escape the intended directory. This enables an attacker to read files outside the web root, including:

• Application configuration files (e.g., application.properties, application.yml)
• Database credentials and connection strings
• Source code and compiled classes
• System files (e.g., /etc/passwd, /etc/shadow)

The attack is performed by sending a crafted HTTP request to the vulnerable endpoint. For example:

GET /novel-plus/file?filePath=../../../etc/passwd HTTP/1.1
Host: target.com

The application does not validate that the resolved path stays within the allowed directory, leading to arbitrary file read.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.1.0):

// Vulnerable: No path validation
public void downloadFile(String filePath, HttpServletResponse response) {
    File file = new File(BASE_DIR, filePath);
    // ... reads and returns file content
}

Patched Code (5.1.0 and later):

// Patched: Canonical path check
public void downloadFile(String filePath, HttpServletResponse response) {
    File file = new File(BASE_DIR, filePath);
    String canonicalPath = file.getCanonicalPath();
    String baseCanonicalPath = new File(BASE_DIR).getCanonicalPath();
    if (!canonicalPath.startsWith(baseCanonicalPath)) {
        throw new SecurityException("Invalid file path");
    }
    // ... reads and returns file content
}

The patch uses getCanonicalPath() to resolve all symbolic links and .. sequences, then verifies that the resulting path starts with the allowed base directory.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A running instance of Novel-plus version < 5.1.0
• Network access to the vulnerable endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /novel-plus/file or /file).
2. Craft a request with path traversal payloads:

   GET /novel-plus/file?filePath=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Observe the response containing the contents of /etc/passwd.
4. For deeper access, attempt to read application configuration files:

   GET /novel-plus/file?filePath=../../../WEB-INF/classes/application.properties HTTP/1.1
   Host: target.com
   

Automated Exploitation (using curl):

curl -v "http://target.com/novel-plus/file?filePath=../../../etc/passwd"

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for requests containing ../ or filePath= parameters.
• Look for repeated attempts to read sensitive files like /etc/passwd, application.properties, or WEB-INF/.

Prevention:

• Immediately upgrade to Novel-plus 5.1.0 or later.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Apply the principle of least privilege to the application user.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search uri_path="*/file*" AND uri_query="*filePath=*"
| regex uri_query="(\.\./|\.\.\\)"
| table _time, clientip, uri_query, status

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with filePath parameter containing ../ or ..\
  • Outbound connections from the server to unknown IPs (if RCE is achieved)
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or application config files
  • Presence of new files in the web root (e.g., webshells)
• Log IOCs:
  • Web server logs showing 200 responses to path traversal requests
  • Application logs with errors related to file reading

Detection Engineering

YARA Rule

rule CVE_2025_45890_Directory_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Novel-plus filePath parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-45890"
    strings:
        $traversal1 = "filePath="
        $traversal2 = "../"
        $traversal3 = "..\\"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "application.properties"
        $sensitive3 = "WEB-INF"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: Novel-plus Directory Traversal Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with path traversal patterns in the filePath parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "filePath="
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in some applications
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-45890 Novel-plus Directory Traversal Attempt"; flow:to_server,established; content:"filePath="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade to Novel-plus version 5.1.0 or later.
2. Workaround: If upgrade is not possible, implement a WAF rule to block requests containing ../ in the filePath parameter.
3. Network Segmentation: Restrict access to the Novel-plus application to trusted IPs only.
4. File System Hardening: Ensure the application runs with minimal file system permissions.
5. Monitoring: Enable detailed logging and alert on path traversal patterns.

Valters IT
Securing Digital Frontiers