CVE-2025-46120

Executive Summary

CVE-2025-46120 is a critical path traversal vulnerability in CommScope Ruckus Unleashed and ZoneDirector wireless controllers. The flaw resides in the web interface, allowing an unauthenticated remote attacker to upload malicious EJS (Embedded JavaScript) templates via FTP and then execute them outside of permitted directories. This enables arbitrary code execution on the controller, leading to full system compromise. The vulnerability affects all versions prior to the specified patches. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk is high due to the unauthenticated nature and the potential for complete device takeover.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in proprietary CommScope/Ruckus software. However, the use of EJS templating within the web interface introduces a dependency risk if the EJS library itself is outdated or misconfigured. Organizations should verify the integrity of their firmware downloads and ensure they are sourced from official CommScope channels.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the affected component are the same.
• Confidentiality Impact: High (C:H) – Full read access to the system.
• Integrity Impact: High (I:H) – Full write access to the system.
• Availability Impact: High (A:H) – Full control, including denial of service.

Threat Level: Critical. The combination of unauthenticated remote access and arbitrary code execution makes this a top-priority vulnerability for any organization using affected Ruckus controllers.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) combined with server-side template injection (SSTI) via EJS. The web interface of the Ruckus controller accepts file uploads (e.g., via FTP) and processes EJS templates. Due to insufficient input validation, an attacker can craft a filename or file path containing directory traversal sequences (e.g., ../../) to write an EJS template outside the intended upload directory.

Once the malicious template is placed in a location accessible by the web server, the attacker can trigger its execution by sending a crafted HTTP request. The EJS template engine then executes arbitrary JavaScript code on the server, allowing the attacker to run system commands, exfiltrate data, or install persistent backdoors.

Attack Flow:

1. Reconnaissance: Identify a vulnerable Ruckus controller (e.g., via Shodan dorks).
2. Upload: Use FTP (often enabled by default on these controllers) to upload a malicious EJS file with a path traversal payload in the filename (e.g., ../../../tmp/evil.ejs).
3. Trigger: Send an HTTP request to the web interface that references the uploaded template (e.g., http://target/tmp/evil.ejs).
4. Execution: The server processes the EJS template, executing the attacker's code with the privileges of the web server (often root).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely uses a function like path.join() or string concatenation without proper sanitization when handling uploaded file paths. For example:

// Vulnerable: Direct concatenation of user input
var uploadPath = '/var/uploads/' + req.body.filename;
fs.writeFileSync(uploadPath, req.body.content);

Patched Code (Conceptual): The patched code should validate and sanitize the file path, ensuring it stays within the intended directory. For example:

// Patched: Resolve and validate the path
var uploadPath = path.resolve('/var/uploads/', req.body.filename);
if (!uploadPath.startsWith('/var/uploads/')) {
    throw new Error('Invalid path');
}
fs.writeFileSync(uploadPath, req.body.content);

Exploitation & Lab Setup

Red Team

Lab Environment:

• Target: Ruckus Unleashed 200.15.6.212.26 (vulnerable) or ZoneDirector 10.5.1.0.281 (vulnerable)
• Attacker: Kali Linux with Metasploit and custom scripts.

Exploitation Steps:

1. Identify Target: Use Shodan or Nmap to find vulnerable controllers.

   nmap -p 21,80,443 --script http-title <target>
   

2. Upload Malicious Template via FTP:
   • Connect to FTP (default credentials often admin/admin or super/sp-admin).
   • Upload a crafted EJS file with a path traversal payload.

   ftp <target>
   # Login with default credentials
   put evil.ejs ../../../tmp/evil.ejs
   

3. Trigger Execution:
   • Send an HTTP request to the uploaded template.

   curl http://<target>/tmp/evil.ejs
   

4. Example EJS Payload (evil.ejs):

   <%
   var exec = require('child_process').exec;
   exec('id', function(error, stdout, stderr) {
       console.log(stdout);
   });
   %>
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection & Response:

• Monitor FTP Logs: Look for unusual file uploads, especially with path traversal patterns (e.g., ../).
• Monitor Web Logs: Detect requests to non-standard paths (e.g., /tmp/, /var/tmp/).
• File Integrity Monitoring: Alert on new files created in sensitive directories (e.g., /tmp, /var/www).
• Network Segmentation: Restrict FTP and HTTP access to the controller to trusted management networks only.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected .ejs files in /tmp/, /var/tmp/, or web-accessible directories.
  • New files with path traversal patterns in their names.
• Network:
  • FTP connections from unusual IP addresses.
  • HTTP requests to paths like /tmp/, /var/tmp/, or ../../../.
• Processes:
  • Unusual child processes spawned by the web server (e.g., node, bash, python).
• Logs:
  • FTP logs showing STOR commands with ../ in the filename.
  • Web server logs showing 200 responses for non-standard template paths.

Detection Engineering

YARA Rule

rule CVE_2025_46120_EJS_Traffic {
    meta:
        description = "Detects EJS template files with path traversal patterns"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46120"
    strings:
        $path_traversal = /\.\.\/[^\/]/
        $ejs_extension = ".ejs"
        $ejs_code = "<%"
    condition:
        $ejs_extension and $path_traversal and $ejs_code
}

Sigma Rule

title: CVE-2025-46120 - Path Traversal in Ruckus Controller
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in FTP uploads to Ruckus controllers
author: Valters IT
date: 2025-04-10
logsource:
    category: ftp
    product: vsftpd
detection:
    selection:
        command: "STOR"
        filename|contains: "../"
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"CVE-2025-46120 - FTP Path Traversal Upload"; flow:to_server; content:"STOR"; nocase; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to the patched versions immediately:
   • Ruckus Unleashed: 200.15.6.212.27 or later, or 200.18.7.1.323 or later.
   • Ruckus ZoneDirector: 10.5.1.0.282 or later.
2. Workaround: If patching is not possible, disable FTP access to the controller or restrict it to trusted IPs only.
3. Network Segmentation: Place the controller in a dedicated management VLAN with strict access controls.

Long-Term Measures:

• Implement file upload validation and path sanitization in all web applications.
• Regularly audit firmware and software for known vulnerabilities.
• Deploy a Web Application Firewall (WAF) to block path traversal attempts.

Valters IT
DevSecOps & Cyber Threat Intelligence