CVE-2025-54387

Executive Summary

CVE-2025-54387 is a path traversal vulnerability in IPX, an image optimizer powered by sharp and svgo. The vulnerability exists in versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0. The flaw lies in the directory validation logic, which uses a raw string prefix comparison to check if a requested path is within allowed directories. This allows an attacker to bypass the check by crafting paths that start with the allowed directory prefix but then escape to parent directories, leading to arbitrary file read on the server.

Supply Chain & Package Security

IPX is distributed as an npm package. The vulnerability affects all users of the affected versions. The package is widely used in web applications for on-the-fly image optimization. The supply chain risk is moderate, as the package is not directly compromised, but vulnerable versions can be exploited if deployed. Users should update to patched versions immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation and the potential for unauthorized access to sensitive files.

Deep Dive & Mechanics

The vulnerability is a classic path traversal (CWE-22) caused by improper input validation. The IPX server checks whether a requested file path is within an allowed directory by using a simple string prefix comparison. For example, if the allowed directory is /var/www/images, the code checks if the requested path starts with /var/www/images. However, this check does not account for path separators. An attacker can request a path like /var/www/images../../etc/passwd, which starts with the allowed prefix but then traverses out of the directory. The fix involves ensuring that the allowed directory path ends with a path separator (e.g., /var/www/images/) and that the requested path is normalized before comparison.

Vulnerable vs. Patched Code

Vulnerable Code (JavaScript):

function isPathAllowed(requestedPath, allowedDir) {
    return requestedPath.startsWith(allowedDir);
}

Patched Code (JavaScript):

const path = require('path');

function isPathAllowed(requestedPath, allowedDir) {
    const normalizedRequested = path.normalize(requestedPath);
    const normalizedAllowed = path.normalize(allowedDir) + path.sep;
    return normalizedRequested.startsWith(normalizedAllowed);
}

The patched version normalizes both paths and ensures the allowed directory ends with a path separator, preventing prefix bypass.

Exploitation & Lab Setup

Red Team

Exploit Description: An attacker can send a crafted HTTP request to the IPX server to read arbitrary files.

Lab Setup:

1. Install a vulnerable version of IPX: npm install ipx@3.0.0
2. Start the server: npx ipx
3. Send a malicious request:

curl "http://localhost:3000/_ipx/f_webp/..%2f..%2fetc%2fpasswd"

This URL-encoded path traverses to /etc/passwd.

Expected Output: The server returns the contents of /etc/passwd.

Blue Team

Detection: Monitor for requests containing path traversal sequences like ../ or ..%2f in the URL path, especially to the IPX endpoint.

Mitigation: Immediately update to patched versions. If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns.

Indicators of Compromise (IOCs)

• Network: HTTP requests to IPX endpoints with path traversal sequences (e.g., ../, ..%2f, %2e%2e%2f).
• File System: Unauthorized access to files outside the allowed directory, such as /etc/passwd, /etc/shadow, or application configuration files.
• Logs: Server logs showing requests with suspicious path patterns.

Detection Engineering

YARA Rule

rule CVE_2025_54387_IPX_Path_Traversal {
    meta:
        description = "Detects path traversal attempts against IPX image optimizer"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54387"
    strings:
        $traversal1 = "..%2f" ascii wide nocase
        $traversal2 = "%2e%2e%2f" ascii wide nocase
        $traversal3 = "../" ascii wide nocase
        $ipx_endpoint = "/_ipx/" ascii wide nocase
    condition:
        $ipx_endpoint and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-54387 IPX Path Traversal Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts against IPX image optimizer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '..%2f'
            - '%2e%2e%2f'
            - '../'
        cs-uri-stem|contains: '/_ipx/'
    condition: selection
falsepositives:
    - Legitimate use of encoded characters in filenames (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54387 IPX Path Traversal Attempt"; flow:to_server,established; content:"/_ipx/"; http_uri; content:"..%2f"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update IPX to version 1.3.2, 2.1.1, or 3.1.1 (depending on your major version).
2. Workaround: If patching is not possible, implement a WAF rule to block path traversal patterns.
3. Long-term: Ensure all path validation logic uses proper normalization and separator checks.
4. Monitoring: Enable logging and alerting for suspicious path patterns.

Report generated by Valters IT DevSecOps AI Assistant