CVE-2025-52450

Executive Summary

CVE-2025-52450 is a critical absolute path traversal vulnerability in Salesforce Tableau Server, affecting the abdoc api - create-data-source-from-file-upload modules on both Windows and Linux platforms. This flaw allows an authenticated attacker to upload files to arbitrary locations on the server filesystem, bypassing intended directory restrictions. The vulnerability exists in versions prior to 2025.1.3, 2024.2.12, and 2023.3.19. Successful exploitation could lead to remote code execution, data exfiltration, or complete server compromise. No public proof-of-concept or exploit code is currently available, but the risk is elevated due to the widespread deployment of Tableau Server in enterprise environments.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in Salesforce Tableau Server, a proprietary enterprise analytics platform. The attack surface is limited to authenticated users with access to the Tableau Server web interface or API.

CVSS Breakdown & Threat Level

The CVSS score is currently unassigned (0.0). Based on the vulnerability characteristics, a reasonable estimated CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability is exploitable remotely via the Tableau Server API.
• Attack Complexity (AC): Low – No special conditions are required; the API endpoint is directly accessible.
• Privileges Required (PR): Low – An attacker needs a valid Tableau Server account with permissions to use the data source upload functionality.
• User Interaction (UI): None – No user interaction is required.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – An attacker can read arbitrary files from the server.
• Integrity (I): High – An attacker can overwrite critical files, potentially leading to code execution.
• Availability (A): High – An attacker could delete or corrupt system files, causing denial of service.

Threat Level: High. The combination of low privileges required and high impact makes this a serious threat for any organization using affected Tableau Server versions.

Deep Dive & Mechanics

The vulnerability resides in the abdoc api module, specifically in the create-data-source-from-file-upload endpoint. This endpoint is designed to allow authenticated users to upload data source files (e.g., TDS, TDSX) to a restricted directory on the server. However, due to improper input validation, the application fails to sanitize the file path provided by the user.

Root Cause: The application does not properly neutralize user-supplied pathnames before using them in file operations. An attacker can inject path traversal sequences (e.g., ../) or absolute paths (e.g., /etc/passwd on Linux, C:\Windows\System32\config\SAM on Windows) to write files outside the intended upload directory.

Attack Flow:

1. The attacker authenticates to the Tableau Server web interface or API.
2. The attacker crafts a malicious HTTP request to the /api/.../create-data-source-from-file-upload endpoint.
3. The request includes a file upload with a manipulated filename parameter containing path traversal sequences (e.g., ../../../../tmp/evil.sh).
4. The server writes the uploaded file to the attacker-specified location.
5. The attacker can then execute the uploaded file (if it is a script) or overwrite critical system files to gain further access.

Impact: Absolute path traversal allows writing to any location on the filesystem. This can be leveraged to:

• Overwrite configuration files (e.g., web.xml, server.xml) to inject malicious settings.
• Upload web shells to the web root for remote code execution.
• Overwrite system binaries or libraries for privilege escalation.
• Write cron jobs or startup scripts for persistence.

Vulnerable vs. Patched Code

The vulnerable code likely resides in a Java class handling file uploads. A simplified example of the vulnerable pattern:

// Vulnerable code
public void handleFileUpload(MultipartFile file, String userProvidedPath) {
    String fullPath = userProvidedPath + "/" + file.getOriginalFilename();
    File dest = new File(fullPath);
    file.transferTo(dest);
}

The patched code would sanitize the path:

// Patched code
public void handleFileUpload(MultipartFile file, String userProvidedPath) {
    // Ensure the path is within the allowed base directory
    Path baseDir = Paths.get("/var/opt/tableau/tableau_server/data/tabsvc/tabadmin/abdoc/");
    Path resolvedPath = baseDir.resolve(userProvidedPath).normalize();
    if (!resolvedPath.startsWith(baseDir)) {
        throw new SecurityException("Invalid path");
    }
    File dest = resolvedPath.toFile();
    file.transferTo(dest);
}

The patch adds canonical path resolution and a check to ensure the final path is within the intended base directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Tableau Server (e.g., version 2023.3.18) on a Linux VM.
2. Create a low-privileged user account with permissions to upload data sources.
3. Use a tool like Burp Suite or curl to interact with the API.

Exploitation Steps:

1. Authenticate and obtain a session token.
2. Craft a multipart POST request to the vulnerable endpoint:

   POST /api/3.12/sites/default/datasources HTTP/1.1
   Host: tableau-server:8850
   Cookie: XSRF-TOKEN=abc123; tableau_session=xyz789
   Content-Type: multipart/form-data; boundary=----WebKitFormBoundary
   
   ------WebKitFormBoundary
   Content-Disposition: form-data; name="upload_file"; filename="../../../../tmp/evil.sh"
   Content-Type: application/octet-stream
   
   #!/bin/bash
   echo "PWNED" > /tmp/pwned.txt
   ------WebKitFormBoundary--
   

3. The file evil.sh is written to /tmp/evil.sh.
4. Execute the script via another vulnerability or by triggering a cron job.

Alternative Payload: Overwrite a Tableau configuration file to inject a reverse shell:

Content-Disposition: form-data; name="upload_file"; filename="../../../../opt/tableau/tableau_server/packages/customer-bin.20233.18.1234/tabsvc/tabadmin/abdoc/config.xml"

Blue Team

Detection:

• Monitor for file uploads to unexpected directories (e.g., /tmp, /etc, /var/www).
• Alert on HTTP requests with path traversal sequences in the filename parameter.
• Use file integrity monitoring (FIM) to detect unauthorized changes to critical system files.

Hunting:

• Search web server logs for requests containing ../ or absolute paths in the filename field.
• Look for files created in non-standard locations by the tableau user.
• Review Tableau Server audit logs for failed path validation attempts.

Mitigation:

• Immediately upgrade to patched versions.
• If patching is not possible, restrict access to the vulnerable API endpoint using network segmentation or WAF rules.
• Implement strict input validation on all file upload endpoints.

Indicators of Compromise (IOCs)

• File System Artifacts:
  • Unexpected files in /tmp, /var/tmp, /etc, /opt/tableau/tableau_server/...
  • Files with names containing path traversal sequences (e.g., ..%2F..%2F..%2Fetc%2Fpasswd)
• Network Indicators:
  • HTTP requests to /api/*/datasources with multipart form data containing ../ in the filename.
  • Outbound connections from the Tableau server to unknown IPs (if a web shell is uploaded).
• Log Indicators:
  • Tableau Server logs showing file write operations to paths outside the expected abdoc directory.
  • Web server logs with 200 responses to requests containing path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_52450_Tableau_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Tableau Server file uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52450"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $tableau_api = /\/api\/\d+\.\d+\/sites\/[^\/]+\/datasources/
    condition:
        $tableau_api and $path_traversal
}

Sigma Rule

title: CVE-2025-52450 Tableau Server Path Traversal
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in Tableau Server file upload API
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - '/api/'
            - '/datasources'
        cs-uri-query|re: '\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate file names containing dots and slashes (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-52450 Tableau Server Path Traversal Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/api/"; http_uri; content:"/datasources"; http_uri; pcre:"/\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tableau Server to version 2025.1.3, 2024.2.12, or 2023.3.19 (or later) as per the vendor advisory.
2. Workaround: If patching is delayed, restrict access to the vulnerable API endpoint using a Web Application Firewall (WAF) or reverse proxy. Block POST requests to /api/*/datasources from untrusted networks.
3. Access Control: Review and minimize the number of users with permissions to upload data sources. Implement the principle of least privilege.

Long-Term Measures:

• Implement input validation and canonical path resolution for all file upload functionality.
• Use a dedicated file upload service that enforces strict path restrictions.
• Regularly audit Tableau Server logs for suspicious file operations.
• Deploy file integrity monitoring (FIM) on critical system directories.

Valters IT – Securing your digital frontier.