CVE-2025-52451

Executive Summary

CVE-2025-52451 is a critical Improper Input Validation vulnerability in Salesforce Tableau Server, affecting the tabdoc api - create-data-source-from-file-upload modules on both Windows and Linux platforms. This flaw allows an authenticated attacker to perform an Absolute Path Traversal attack, potentially reading arbitrary files from the server's filesystem. The vulnerability exists in versions before 2025.1.3, before 2024.2.12, and before 2023.3.19. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild. However, given the nature of the vulnerability and the widespread use of Tableau Server in enterprise environments, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a server-side application vulnerability in Salesforce Tableau Server, a proprietary enterprise analytics platform. The risk is primarily to organizations that self-host Tableau Server, as the file upload API endpoint could be abused to read sensitive configuration files, credentials, or data sources.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder. Based on the vulnerability description (Absolute Path Traversal via file upload), a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An authenticated user with access to the file upload API is needed.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read can expose sensitive data.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. While the impact on confidentiality is high, the requirement for authentication and the lack of public exploit code reduce the immediate threat. However, the vulnerability is trivial to exploit once discovered, and internal attackers or compromised accounts pose a significant risk.

Deep Dive & Mechanics

The vulnerability resides in the tabdoc api - create-data-source-from-file-upload modules of Tableau Server. This API endpoint is designed to allow users to upload files (e.g., TDS, TWB, hyper extracts) to create new data sources. The flaw is an Improper Input Validation leading to an Absolute Path Traversal (CWE-22).

How it works:

1. Normal Operation: When a user uploads a file, the server typically validates the filename to ensure it is a safe relative path (e.g., data_source.tds). The server then saves the file to a designated upload directory.
2. Vulnerable Behavior: The vulnerable code does not properly sanitize the filename or the file path provided in the upload request. An attacker can manipulate the filename to include absolute path components, such as C:\Windows\win.ini (Windows) or /etc/passwd (Linux).
3. Exploitation: By sending a crafted HTTP request to the vulnerable API endpoint with a filename like ../../../../etc/passwd or C:\Windows\System32\drivers\etc\hosts, the server will attempt to read the specified file from the filesystem and return its contents in the response, or in some cases, write the uploaded content to an arbitrary location (though the description only mentions path traversal, not arbitrary write).
4. Impact: An attacker can read any file that the Tableau Server process has read access to. This includes:
   • Configuration files (e.g., tableau_config.yml, tabsvc.yml)
   • Credential files (e.g., database connection strings, service account passwords)
   • Source code or proprietary data
   • System files (e.g., /etc/shadow, SAM file on Windows)

The vulnerability is present in all supported versions prior to the patched releases. The patch likely involves strict validation of the filename parameter, rejecting any input that contains path traversal sequences (../, ..\\) or absolute paths.

Vulnerable vs. Patched Code

Since no specific code is provided, the following is a representative example of the vulnerable and patched logic.

Vulnerable Code (Python/Flask-like example):

@app.route('/api/create-data-source-from-file-upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = request.form.get('filename', file.filename)
    # VULNERABLE: No validation of filename
    filepath = os.path.join(UPLOAD_DIR, filename)
    file.save(filepath)
    return jsonify({"status": "success", "path": filepath})

Patched Code:

import os
import re

ALLOWED_EXTENSIONS = {'.tds', '.twb', '.hyper', '.tde'}

def is_safe_filename(filename):
    # Reject any path traversal or absolute paths
    if '..' in filename or filename.startswith('/') or filename.startswith('\\'):
        return False
    # Reject Windows drive letters
    if re.match(r'^[a-zA-Z]:\\', filename):
        return False
    # Ensure only allowed extensions
    ext = os.path.splitext(filename)[1].lower()
    return ext in ALLOWED_EXTENSIONS

@app.route('/api/create-data-source-from-file-upload', methods=['POST'])
def upload_file():
    file = request.files['file']
    filename = request.form.get('filename', file.filename)
    if not is_safe_filename(filename):
        return jsonify({"error": "Invalid filename"}), 400
    filepath = os.path.join(UPLOAD_DIR, filename)
    # Ensure the final path is still within UPLOAD_DIR
    real_upload = os.path.realpath(UPLOAD_DIR)
    real_filepath = os.path.realpath(filepath)
    if not real_filepath.startswith(real_upload):
        return jsonify({"error": "Path traversal detected"}), 400
    file.save(filepath)
    return jsonify({"status": "success", "path": filepath})

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Tableau Server instance (version < 2025.1.3, < 2024.2.12, or < 2023.3.19).
• Valid credentials for a user with permission to upload data sources (typically a Creator or Explorer role).

Exploitation Steps:

1. Identify the vulnerable endpoint: The API is typically located at:

   POST /api/3.12/sites/{site-id}/datasources
   

   or similar. The exact path may vary by version.

2. Craft the malicious request: Use curl or a tool like Burp Suite to send a file upload request with a manipulated filename.

   Example (Linux):

   curl -k -X POST \
     -H "X-Tableau-Auth: <your_token>" \
     -F "request_payload={\"datasource\":{\"name\":\"test\"}}" \
     -F "tableau_file=@/dev/null;filename=../../../../etc/passwd" \
     "https://tableau-server/api/3.12/sites/MySite/datasources"
   

   Example (Windows):

   curl -k -X POST \
     -H "X-Tableau-Auth: <your_token>" \
     -F "request_payload={\"datasource\":{\"name\":\"test\"}}" \
     -F "tableau_file=@NUL;filename=C:\\Windows\\win.ini" \
     "https://tableau-server/api/3.12/sites/MySite/datasources"
   

3. Observe the response: If successful, the server may return the contents of the requested file in the response body or error message. Alternatively, the file might be saved to an arbitrary location, but the primary goal is reading.

Note: No public exploit code is available. The above is a theoretical exploitation based on the vulnerability description.

Blue Team

Detection & Prevention:

1. Monitor API Logs: Look for unusual filenames in upload requests, especially those containing .., /, \, or absolute paths like C:\ or /etc/.
2. Web Application Firewall (WAF): Deploy WAF rules to block path traversal patterns in file upload parameters.
   • Example ModSecurity rule:

     SecRule ARGS_NAMES|ARGS "@contains ../" "id:10001,phase:2,deny,status:403,msg:'Path Traversal Attempt'"
     

3. File Integrity Monitoring (FIM): Monitor the Tableau Server upload directories for unexpected files or changes.
4. Least Privilege: Ensure the Tableau Server service account has minimal filesystem permissions. It should not have read access to sensitive system files.
5. Network Segmentation: Restrict access to the Tableau Server API to trusted networks only.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/*/sites/*/datasources with filenames containing ../, ..\\, /etc/, C:\, or other path traversal sequences.
  • Unusual response sizes or error messages containing file contents (e.g., root:x:0:0:root in the response).
• File System IOCs:
  • Unexpected files in the Tableau Server upload directories (e.g., /opt/tableau/tableau_server/data/tabsvc/tabadmin/upload/).
  • Files with names that appear to be system files (e.g., passwd, win.ini, shadow).
• Log IOCs:
  • Tableau Server logs (e.g., tabadmin.log, vizportal.log) showing errors related to file path validation or file read failures.
  • Application logs containing stack traces with path traversal strings.

Detection Engineering

YARA Rule

rule CVE_2025_52451_Tableau_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Tableau Server file upload requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52451"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $path_traversal_linux = /\.\.\/\.\.\/\.\.\/(etc|var|proc|boot|sys|usr|home|root|tmp|dev|run|mnt|media|srv|opt)/
        $path_traversal_windows = /[a-zA-Z]:\\(Windows|Program\s?Files|Users|System32|Temp|etc)/
        $path_traversal_generic = /\.\.(\/|\\)/
        $api_endpoint = /\/api\/\d+\.\d+\/sites\/[^\/]+\/datasources/
    condition:
        any of ($path_traversal_*) and $api_endpoint
}

Sigma Rule

title: CVE-2025-52451 - Tableau Server Path Traversal via File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to Tableau Server API with path traversal patterns in filenames
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-52451
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/'
            - '/datasources'
        cs-uri-query|re:
            - '\.\.\/'
            - '\.\.\\'
            - 'C:\\'
            - '/etc/'
    condition: selection
falsepositives:
    - Legitimate file names containing dots (e.g., "report_v2.1.tds")
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-52451 - Tableau Server Path Traversal Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/"; http_uri;
    content:"/datasources"; http_uri;
    pcre:"/(\.\.(\/|\\)|[a-zA-Z]:\\(Windows|Program\s?Files|Users|System32|Temp|etc)|\/etc\/)/Ui";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-52451;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tableau Server to the latest patched version:
   • 2025.1.3 or later
   • 2024.2.12 or later
   • 2023.3.19 or later
2. Workaround: If patching is not immediately possible, restrict access to the vulnerable API endpoint using a reverse proxy or WAF. Block any requests containing path traversal patterns.
3. Review Access: Audit all user accounts with file upload permissions. Remove unnecessary privileges.
4. Monitor: Enable detailed logging for the Tableau Server API and monitor for suspicious activity.

Long-Term Measures:

• Implement strict input validation for all file upload endpoints.
• Use a secure file upload library that automatically sanitizes filenames.
• Conduct regular security assessments and penetration testing.
• Follow the principle of least privilege for service accounts.

Valters IT