CVE-2025-54963

Executive Summary

CVE-2025-54963 is a directory traversal vulnerability in BAE Systems SOCET GXP, a geospatial intelligence (GEOINT) software suite. The flaw resides in the GXP Job Service component, which fails to sanitize file paths when processing crafted job requests. An authenticated attacker with network access to the Job Service can exploit this to read arbitrary files from the filesystem with the privileges of the GXP Job Service process. This can lead to the exfiltration of sensitive configuration files, credentials, or other intelligence data. No public proof-of-concept (PoC) or exploit code is currently available, and the vendor has released a patch in version 4.6.0.2.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, indicating that no official CVSS vector has been assigned by NVD at this time. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (AV:N) – The Job Service is network-accessible.
• Attack Complexity (AC): Low (AC:L) – No special conditions required.
• Privileges Required (PR): Low (PR:L) – An attacker must have the ability to interact with the Job Service (authenticated user).
• User Interaction (UI): None (UI:N) – No user action needed.
• Scope (S): Unchanged (S:U) – The vulnerable component is the only one affected.
• Confidentiality (C): High (C:H) – Sensitive files can be read.
• Integrity (I): None (I:N) – No write capability.
• Availability (A): None (A:N) – No denial of service.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: Medium. The vulnerability requires authentication but can lead to significant data leakage in a GEOINT environment.

Deep Dive & Mechanics

The GXP Job Service is a core component of SOCET GXP that processes user-submitted jobs (e.g., image processing, analysis tasks). The vulnerability lies in the file path handling logic within the job request parser. When a user submits a job that references a file (e.g., an input image or output location), the service does not validate or sanitize the path for directory traversal sequences such as ../.

An attacker can craft a job request that includes a path like ../../../../etc/passwd or ../../../../etc/shadow (or other sensitive files). The GXP Job Service, running with the privileges of the service account (often a local system or domain user), will attempt to open the file at the resolved path. If the file exists and the service account has read permissions, the file contents are returned to the attacker as part of the job response or error message.

The vulnerability is present in all versions prior to 4.6.0.2. The fix likely involves implementing proper path canonicalization and validation, ensuring that all file paths are resolved to a safe base directory and that traversal sequences are rejected.

Vulnerable vs. Patched Code

Since the source code is proprietary, we can only infer the fix. The vulnerable code likely resembles:

# Vulnerable pseudo-code
def process_job(job_request):
    input_file = job_request['input_path']
    # No sanitization
    with open(input_file, 'r') as f:
        data = f.read()
    # Process data...

The patched code would include path validation:

# Patched pseudo-code
import os

def process_job(job_request):
    input_file = job_request['input_path']
    # Canonicalize and validate path
    safe_base = "/var/socet_gxp/data/"
    full_path = os.path.normpath(os.path.join(safe_base, input_file))
    if not full_path.startswith(safe_base):
        raise ValueError("Invalid path")
    with open(full_path, 'r') as f:
        data = f.read()
    # Process data...

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a SOCET GXP instance (version < 4.6.0.2) with the GXP Job Service exposed on the network.
• Valid credentials for a user who can submit jobs (e.g., via the GXP API or web interface).

Exploitation Steps:

1. Identify the Job Service endpoint. This is typically an HTTP or RPC endpoint (e.g., http://target:8080/jobservice).

2. Craft a malicious job request. The exact format depends on the API, but a generic example using a REST API might look like:

{
  "job_type": "image_analysis",
  "input_file": "../../../../etc/passwd",
  "parameters": {}
}

3. Submit the request. Use curl or a custom script:

curl -X POST -H "Content-Type: application/json" -d '{"job_type":"image_analysis","input_file":"../../../../etc/passwd","parameters":{}}' -u username:password http://target:8080/jobservice

4. Retrieve the response. The file contents may be returned in the job result or an error message.

Expected Output: The contents of /etc/passwd (or other targeted file) will be displayed.

Blue Team

Detection:

• Monitor for job requests containing ../ or other path traversal patterns in the input_file or similar parameters.
• Alert on unusual file access patterns by the GXP Job Service process (e.g., reading /etc/passwd, /etc/shadow, or files outside the expected data directory).
• Use file integrity monitoring (FIM) to detect when the GXP Job Service accesses sensitive system files.

Hunting:

• Search logs for job submissions with paths containing .. or absolute paths (e.g., starting with /).
• Correlate with network connections from the GXP Job Service to internal hosts (if the service reads from network shares).

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to the GXP Job Service endpoint with JSON payloads containing ../ sequences.
• File System: The GXP Job Service process (e.g., gxp_job_service.exe or java) reading files outside its expected working directory (e.g., /etc/passwd, C:\Windows\System32\config\SAM).
• Logs: Application logs showing errors like FileNotFoundError for paths containing .. or successful reads of sensitive files.
• Process: Unusual child processes spawned by the GXP Job Service (e.g., cmd.exe or /bin/sh if the attacker tries to escalate).

Detection Engineering

YARA Rule

rule CVE_2025_54963_GXP_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in GXP Job Service requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54963"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e%5c"
        $sensitive1 = "/etc/passwd"
        $sensitive2 = "/etc/shadow"
        $sensitive3 = "boot.ini"
        $sensitive4 = "windows\\system32"
    condition:
        any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-54963 - GXP Job Service Directory Traversal
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects directory traversal attempts targeting BAE SOCET GXP Job Service
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: socet_gxp
detection:
    selection:
        EventID: 4625  # Example: Windows Security Log for file access
        ObjectName|contains:
            - '..\\'
            - '../'
            - '/etc/passwd'
            - '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in job definitions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-54963 - GXP Job Service Directory Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/jobservice"; http_uri; content:"../"; within:100; pcre:"/\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to BAE SOCET GXP version 4.6.0.2 or later, which contains the fix.
2. If upgrade is not possible, restrict network access to the GXP Job Service to only trusted hosts using firewall rules.
3. Apply the principle of least privilege to the GXP Job Service account. Ensure it does not have read access to sensitive system files (e.g., /etc/shadow, C:\Windows\System32\config).

Long-term:

• Implement input validation and sanitization for all file paths in the application.
• Use a chroot jail or containerization to isolate the GXP Job Service process.
• Conduct regular security audits and penetration testing on GEOINT software.

Workaround:

• If the Job Service is not required, disable it.
• Use a web application firewall (WAF) to block requests containing ../ patterns.

Valters IT
DevSecOps & Cyber Threat Intelligence