CVE-2025-5385

Executive Summary

CVE-2025-5385 is a critical path traversal vulnerability in JeeWMS, an open-source warehouse management system. The flaw resides in the /cgformTemplateController.do?doAdd endpoint, allowing an unauthenticated remote attacker to manipulate file paths and potentially read, write, or delete arbitrary files on the server. With a CVSS score of 0.0 (placeholder) but a critical severity rating, this vulnerability poses a high risk to confidentiality, integrity, and availability. No public exploit or patch is currently available, and the vendor’s rolling release model makes version tracking difficult.

Supply Chain & Package Security

JeeWMS is a Java-based application typically deployed as a WAR file or Docker container. The vulnerability is in the application’s own code, not in a third-party package. However, organizations using JeeWMS should verify their deployment’s integrity and monitor for any malicious modifications to the application’s files.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Arbitrary file read possible.
• Integrity (I): High (H) – Arbitrary file write/overwrite possible.
• Availability (A): High (H) – Could lead to denial of service via file deletion.

Threat Level: Critical. Immediate attention required.

Deep Dive & Mechanics

The vulnerability exists in the doAdd function of the cgformTemplateController class. This function handles file uploads or template creation without properly sanitizing user-supplied file paths. By injecting path traversal sequences (e.g., ../), an attacker can escape the intended directory and access or modify files anywhere on the filesystem.

Root Cause: The application uses user input to construct file paths without validation or canonicalization. For example, a request like:

POST /cgformTemplateController.do?doAdd
Content-Type: multipart/form-data

file=../../../etc/passwd

could allow reading sensitive system files.

Impact:

• Read configuration files (e.g., database credentials, application secrets).
• Overwrite application files (e.g., JSP, class files) to execute arbitrary code.
• Delete critical files, causing denial of service.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison.

Vulnerable Code (Java):

public void doAdd(HttpServletRequest request, HttpServletResponse response) {
    String filePath = request.getParameter("filePath");
    // No validation – directly used
    File file = new File(baseDir + filePath);
    // ... process file
}

Patched Code (Hypothetical):

public void doAdd(HttpServletRequest request, HttpServletResponse response) {
    String filePath = request.getParameter("filePath");
    // Sanitize: remove path traversal sequences
    filePath = filePath.replace("../", "").replace("..\\", "");
    // Or use a whitelist of allowed paths
    if (!filePath.startsWith("/allowed/dir/")) {
        throw new SecurityException("Invalid path");
    }
    File file = new File(baseDir + filePath);
    // ... process file
}

Note: The vendor’s rolling release model means the fix may be included in a future build without explicit versioning.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable JeeWMS instance (e.g., using Docker image jeewms/jeewms:latest from before May 2024).
2. Reconnaissance: Identify the endpoint via directory brute-forcing or by reviewing source code.
3. Exploit: Send a crafted POST request to traverse directories.

Example cURL command:

curl -X POST "http://target:8080/cgformTemplateController.do?doAdd" \
  -F "file=@/etc/passwd" \
  -F "filePath=../../../etc/passwd"

Expected Result: The contents of /etc/passwd are returned or written to a location accessible to the attacker.

Blue Team (Defense & Detection)

1. Monitor Logs: Look for requests to /cgformTemplateController.do?doAdd with suspicious parameters containing ../ or ..\\.
2. Web Application Firewall (WAF): Block requests with path traversal patterns in the filePath parameter.
3. File Integrity Monitoring (FIM): Alert on unexpected changes to application files (e.g., JSP, class files).
4. Network Segmentation: Restrict outbound access from the application server to prevent data exfiltration.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /cgformTemplateController.do?doAdd with filePath containing ../ or ..\\.
• File System: Unexpected files in /tmp, /var/www, or application directories (e.g., webapps/ROOT/).
• Logs: Application logs showing FileNotFoundException or SecurityException for paths outside the intended directory.
• Process: Unusual Java processes reading or writing files outside the application’s base directory.

Detection Engineering

YARA Rule

rule CVE_2025_5385_PathTraversal {
    meta:
        description = "Detects path traversal attempts in JeeWMS cgformTemplateController"
        author = "Valters IT"
        date = "2025-05-05"
        reference = "CVE-2025-5385"
    strings:
        $s1 = "cgformTemplateController.do?doAdd" nocase
        $s2 = "../" ascii wide
        $s3 = "..\\" ascii wide
    condition:
        $s1 and ($s2 or $s3)
}

Sigma Rule

title: JeeWMS Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting CVE-2025-5385
author: Valters IT
date: 2025-05-05
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'cgformTemplateController.do?doAdd'
        cs-uri-query|contains|all:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in template names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5385 JeeWMS Path Traversal Attempt"; flow:to_server; content:"POST"; http_method; content:"cgformTemplateController.do?doAdd"; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply input validation to the filePath parameter – reject any input containing ../ or ..\\.
2. Short-term: Use a WAF to block path traversal patterns.
3. Long-term: Update to the latest rolling release of JeeWMS (check the vendor’s repository for fixes). If no patch is available, consider forking the project and implementing proper path canonicalization.
4. Compensating Controls: Run the application in a container with a read-only filesystem where possible. Use a reverse proxy to restrict access to the vulnerable endpoint.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert